Overview

overview

7

Static

static

3

eacbb24d48...cc.exe

windows10-2004-x64

7

eacbb24d48...cc.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/08/2026, 18:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
  • Size 3.5MB
  • Sample260801-xdhgdsem8v
  • SHA256 eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
    "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4608
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3BF.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:704
      • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
        "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:6000
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a73A.bat
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:6072
          • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
            "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:4264
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a96C.bat
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:2560
              • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:5944
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB8F.bat
                  8⤵
                  • Executes a command shell one-liner
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:3832
                  • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                    "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of WriteProcessMemory
                    PID:344
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE00.bat
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:260
                      • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                        "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of WriteProcessMemory
                        PID:5840
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFF4.bat
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:2828
                          • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                            "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:700
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a11C9.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:1216
                              • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious use of WriteProcessMemory
                                PID:3952
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a142A.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:2864
                                  • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                    "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:1152
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a15EF.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:4680
                                      • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                        "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:3592
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1831.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:1056
                                          • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                            "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of WriteProcessMemory
                                            PID:1496
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1F27.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • Suspicious use of WriteProcessMemory
                                              PID:3908
                                              • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of WriteProcessMemory
                                                PID:1268
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a237C.bat
                                                  24⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:960
                                                  • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:5300
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a25BE.bat
                                                      26⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:5876
                                                      • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        PID:2680
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a308C.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:5368
                                                          • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                            29⤵
                                                            • Drops file in Windows directory
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:2192
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3B2B.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:6060
                                                              • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:3308
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3C53.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:5932
                                                                  • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:2280
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3E38.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:2368
                                                                      • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:2016
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4184.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:1292
                                                                          • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:5860
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4329.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:3240
                                                                              • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:256
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a450E.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:4400
                                                                                  • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:1124
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4740.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:852
                                                                                      • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:1968
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a48A8.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:4892
                                                                                          • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:2344
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5162.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:1696
                                                                                              • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:468
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a525C.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:1180
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:1068
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5337.bat
                                                                                                      50⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:5792
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:4964
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a547F.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:3460
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:4916
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5569.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:5352
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:1244
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5673.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:1524
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:2572
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a576D.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:2552
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:4732
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5848.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:3328
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:3452
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5922.bat
                                                                                                                              62⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                              PID:3620
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Drops file in Windows directory
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:3800
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a59EE.bat
                                                                                                                                  64⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  PID:6068
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                    65⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Drops file in Windows directory
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:3004
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5AE8.bat
                                                                                                                                      66⤵
                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                      PID:624
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                        67⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        PID:3228
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5CBC.bat
                                                                                                                                          68⤵
                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:2060
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                            69⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:5424
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5DA7.bat
                                                                                                                                              70⤵
                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                              PID:900
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                71⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:1560
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5EB0.bat
                                                                                                                                                  72⤵
                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:1408
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                    73⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                    PID:3796
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6027.bat
                                                                                                                                                      74⤵
                                                                                                                                                        PID:2312
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                          75⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                          PID:2568
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a618F.bat
                                                                                                                                                            76⤵
                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                            PID:4948
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                              77⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                              PID:3108
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6279.bat
                                                                                                                                                                78⤵
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:4292
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                  79⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  PID:3948
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6344.bat
                                                                                                                                                                    80⤵
                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:6112
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                      81⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                      PID:4852
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a642F.bat
                                                                                                                                                                        82⤵
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:5532
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                          83⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:840
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6519.bat
                                                                                                                                                                            84⤵
                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                            PID:1580
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                              85⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:4524
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6603.bat
                                                                                                                                                                                86⤵
                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                PID:1820
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                                  87⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  PID:4216
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a66DE.bat
                                                                                                                                                                                    88⤵
                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:2608
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                                      89⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:5124
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a679A.bat
                                                                                                                                                                                        90⤵
                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                        PID:5496
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                                          91⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:5404
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6884.bat
                                                                                                                                                                                            92⤵
                                                                                                                                                                                              PID:5348
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                                                93⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                PID:1364
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a695F.bat
                                                                                                                                                                                                  94⤵
                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                  PID:3304
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                                                    95⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:1360
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6A2A.bat
                                                                                                                                                                                                      96⤵
                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                      PID:4248
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                                                        97⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                        PID:5316
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6B05.bat
                                                                                                                                                                                                          98⤵
                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                          PID:4572
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                                                            99⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                            PID:5028
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6BD0.bat
                                                                                                                                                                                                              100⤵
                                                                                                                                                                                                                PID:4636
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                                                                  101⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  PID:5248
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6CAA.bat
                                                                                                                                                                                                                    102⤵
                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                    PID:2640
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                                                                      103⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      PID:2844
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6D76.bat
                                                                                                                                                                                                                        104⤵
                                                                                                                                                                                                                          PID:1984
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                                                                            105⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:5468
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6E50.bat
                                                                                                                                                                                                                              106⤵
                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                              PID:3992
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                                                                                107⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                PID:2808
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6F2B.bat
                                                                                                                                                                                                                                  108⤵
                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                  PID:5168
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                                                                                    109⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                    PID:364
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7006.bat
                                                                                                                                                                                                                                      110⤵
                                                                                                                                                                                                                                        PID:3176
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                                                                                          111⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          PID:1296
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a70A2.bat
                                                                                                                                                                                                                                            112⤵
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:696
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                                                                                              113⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:1392
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a716D.bat
                                                                                                                                                                                                                                                114⤵
                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                PID:4900
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                                                                                                  115⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                  PID:4104
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7238.bat
                                                                                                                                                                                                                                                    116⤵
                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    PID:3756
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                                                                                                      117⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                      PID:3488
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7313.bat
                                                                                                                                                                                                                                                        118⤵
                                                                                                                                                                                                                                                          PID:2508
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                                                                                                            119⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            PID:5696
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a73FD.bat
                                                                                                                                                                                                                                                              120⤵
                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                              PID:2324
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                                                                                                                121⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                PID:3000
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a74A9.bat
                                                                                                                                                                                                                                                                  122⤵
                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                  PID:5000
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                                                                                                                    123⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                    PID:3964
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7584.bat
                                                                                                                                                                                                                                                                      124⤵
                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                      PID:5080
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                                                                                                                        125⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                        PID:5632
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a764F.bat
                                                                                                                                                                                                                                                                          126⤵
                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                          PID:1240
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                                                                                                                            127⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                            PID:2484
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a771A.bat
                                                                                                                                                                                                                                                                              128⤵
                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                              PID:3368
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                                                                                                                                129⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                PID:2256
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a77E5.bat
                                                                                                                                                                                                                                                                                  130⤵
                                                                                                                                                                                                                                                                                    PID:2104
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                                                                                                                                      131⤵
                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      PID:3400
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a78C0.bat
                                                                                                                                                                                                                                                                                        132⤵
                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                        PID:2216
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                                                                                                                                          133⤵
                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                          PID:4188
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a795C.bat
                                                                                                                                                                                                                                                                                            134⤵
                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                            PID:4180
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                                                                                                                                              135⤵
                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                              PID:5940
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A76.bat
                                                                                                                                                                                                                                                                                                136⤵
                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                PID:4144
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                                                                                                                                                  137⤵
                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                  PID:5192
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7B50.bat
                                                                                                                                                                                                                                                                                                    138⤵
                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                    PID:5372
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                                                                                                                                                      139⤵
                                                                                                                                                                                                                                                                                                        PID:5616
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7C2B.bat
                                                                                                                                                                                                                                                                                                          140⤵
                                                                                                                                                                                                                                                                                                            PID:2892
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                                                                                                                                                              141⤵
                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                              PID:5012
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7D06.bat
                                                                                                                                                                                                                                                                                                                142⤵
                                                                                                                                                                                                                                                                                                                  PID:4944
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                                                                                                                                                                    143⤵
                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                    PID:248
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7DB2.bat
                                                                                                                                                                                                                                                                                                                      144⤵
                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                      PID:2272
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                                                                                                                                                                        145⤵
                                                                                                                                                                                                                                                                                                                          PID:5972
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E4E.bat
                                                                                                                                                                                                                                                                                                                            146⤵
                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                            PID:4668
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                                                                                                                                                                              147⤵
                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                              PID:5636
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7F19.bat
                                                                                                                                                                                                                                                                                                                                148⤵
                                                                                                                                                                                                                                                                                                                                  PID:952
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                                                                                                                                                                                    149⤵
                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                    PID:5508
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7FE4.bat
                                                                                                                                                                                                                                                                                                                                      150⤵
                                                                                                                                                                                                                                                                                                                                        PID:5472
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                                                                                                                                                                                          151⤵
                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                          PID:3824
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8090.bat
                                                                                                                                                                                                                                                                                                                                            152⤵
                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                            PID:5780
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                                                                                                                                                                                              153⤵
                                                                                                                                                                                                                                                                                                                                                PID:4472
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a814C.bat
                                                                                                                                                                                                                                                                                                                                                  154⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                  PID:3440
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                                                                                                                                                                                                    155⤵
                                                                                                                                                                                                                                                                                                                                                      PID:4440
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8217.bat
                                                                                                                                                                                                                                                                                                                                                        156⤵
                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                        PID:4152
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                                                                                                                                                                                                          157⤵
                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                          PID:6076
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a82D2.bat
                                                                                                                                                                                                                                                                                                                                                            158⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                            PID:476
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                                                                                                                                                                                                              159⤵
                                                                                                                                                                                                                                                                                                                                                                PID:4532
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a838E.bat
                                                                                                                                                                                                                                                                                                                                                                  160⤵
                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                  PID:756
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                                                                                                                                                                                                                    161⤵
                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                    PID:2624
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8469.bat
                                                                                                                                                                                                                                                                                                                                                                      162⤵
                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                      PID:3980
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                                                                                                                                                                                                                        163⤵
                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                        PID:1104
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8553.bat
                                                                                                                                                                                                                                                                                                                                                                          164⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:4724
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                                                                                                                                                                                                                              165⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:1472
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a861E.bat
                                                                                                                                                                                                                                                                                                                                                                                  166⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:4100
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                                                                                                                                                                                                                                      167⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                      PID:5604
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8831.bat
                                                                                                                                                                                                                                                                                                                                                                                        168⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                        PID:6048
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                                                                                                                                                                                                                                          169⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                          PID:1076
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a88DD.bat
                                                                                                                                                                                                                                                                                                                                                                                            170⤵
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            PID:1976
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                                                                                                                                                                                                                                              171⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                              PID:2496
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8989.bat
                                                                                                                                                                                                                                                                                                                                                                                                172⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                PID:5016
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  173⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4452
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A45.bat
                                                                                                                                                                                                                                                                                                                                                                                                      174⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5092
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        175⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                        PID:2300
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B00.bat
                                                                                                                                                                                                                                                                                                                                                                                                          176⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                          PID:1740
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            177⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2452
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B9C.bat
                                                                                                                                                                                                                                                                                                                                                                                                              178⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5520
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1344
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C39.bat
                                                                                                                                                                                                                                                                                                                                                                                                                  180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3804
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2200
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8CD5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                          182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3648
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5476
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D90.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4644
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4476
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E3C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                      186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5144
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1040
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8EE8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                            188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5296
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3332
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F84.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6120
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4360
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9030.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                        192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3920
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2812
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a90EC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                              194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3432
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3548
                                                            • C:\Windows\Logo1_.exe
                                                              C:\Windows\Logo1_.exe
                                                              2⤵
                                                              • Creates a file in the Startup directory
                                                              • Executes dropped EXE
                                                              • Enumerates connected drives
                                                              • Drops file in Program Files directory
                                                              • Drops file in Windows directory
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:3444
                                                              • C:\Windows\SysWOW64\net.exe
                                                                net stop "Kingsoft AntiVirus Service"
                                                                3⤵
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:5968
                                                                • C:\Windows\SysWOW64\net1.exe
                                                                  C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                  4⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:5228

                                                          Network

                                                                MITRE ATT&CK Enterprise v16

                                                                Replay Monitor

                                                                Loading Replay Monitor...

                                                                Downloads

                                                                $$a11C9.bat
                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a11C9.bat
                                                                • Size 722B
                                                                • SHA256 055c35ad43a3f85e26be1da1c4787038b871021bb98d8ceb4a348b3cdf12a922
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                $$a142A.bat
                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a142A.bat
                                                                • Size 722B
                                                                • SHA256 7cf9db6fd86da9eb0dd188d2edb9e3c1d2619d4c756a6c92797ad08d54932c86
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                $$a15EF.bat
                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a15EF.bat
                                                                • Size 722B
                                                                • SHA256 1ba873560b60cbfda3d754f2c42e80a9ca8b76762c4a1c3901ea512535957193
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                $$a1831.bat
                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a1831.bat
                                                                • Size 722B
                                                                • SHA256 a299990a4fd875d48994c9727778baae342cd08225e356236e2b226e84f5ab70
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                $$a1F27.bat
                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a1F27.bat
                                                                • Size 722B
                                                                • SHA256 ba3edb9dc091578b2746d1a6d56c7696ddae34b61da9c83f323d2e25a2d7491f
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                $$a237C.bat
                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a237C.bat
                                                                • Size 722B
                                                                • SHA256 6ab5736e8f13e22316a74b08d4d06114b5a2e1b25a8e78f33400fdcc1205762b
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                $$a25BE.bat
                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a25BE.bat
                                                                • Size 722B
                                                                • SHA256 0cf73a15b44047a94e48937598ced04a8ea319d360a9815cddb1f27707c5606a
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                $$a3B2B.bat
                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a3B2B.bat
                                                                • Size 722B
                                                                • SHA256 2f561d9a46936460d4553166ac8956b18912f9e2c329bb39354eaad5d428ce12
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                $$a3BF.bat
                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a3BF.bat
                                                                • Size 721B
                                                                • SHA256 b5fd856806433756dc99d27dfaaa82626e958a2ce234c4451fc38f88930bd145
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                $$a3C53.bat
                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a3C53.bat
                                                                • Size 722B
                                                                • SHA256 3a50282c8b9073a5a37d806fa5be3089a7d2fd0325f8d34f4d21a84f586f492d
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                $$a3E38.bat
                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a3E38.bat
                                                                • Size 722B
                                                                • SHA256 7bcba0993f253850469a8269e64867a7bf790201fd4c5a439ebb08c9805fffed
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                $$a4184.bat
                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a4184.bat
                                                                • Size 722B
                                                                • SHA256 817fccbff235e3a4cb60550fa3408491b6cd91bd52d1b34956368a4b25d1e8d2
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                $$a4329.bat
                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a4329.bat
                                                                • Size 722B
                                                                • SHA256 079993e18e288946432030c3a893aa2f8cb518573663e1c3a8bb7b9535dbd2ef
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                $$a450E.bat
                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a450E.bat
                                                                • Size 722B
                                                                • SHA256 7cb4011467d88687098e234b45002908fe4d0627a8953b3bb9e70f22091e7006
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                $$a4740.bat
                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a4740.bat
                                                                • Size 722B
                                                                • SHA256 64d01f789cc90f1c24efa995ab0b4d182c30b2e92742cededbd96fcc7c322c2c
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                $$a48A8.bat
                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a48A8.bat
                                                                • Size 722B
                                                                • SHA256 4ff5953b419a13f3377f986aeae10e8512a94972f62ff96f44182ee73d9445bb
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                $$a73A.bat
                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a73A.bat
                                                                • Size 721B
                                                                • SHA256 9bf3471fc2aa8df270a9a33da51a6c47ec2ca0b5e55c355059dcc8e2e4788685
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                $$a96C.bat
                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a96C.bat
                                                                • Size 721B
                                                                • SHA256 9ba3651f3e65d31139a2b82f75913554037176d18fecca89f924d4ab7c8dc0e5
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                $$aB8F.bat
                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aB8F.bat
                                                                • Size 721B
                                                                • SHA256 9ce887c5ffa8a1db60ca9c8709cffe6ddd515006b31ab21ceed3f37e24514002
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                $$aE00.bat
                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aE00.bat
                                                                • Size 721B
                                                                • SHA256 56d3575050b5a1e5c6af03a719539e92dc23bc55c04a3e9c512c91c9f4428774
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                $$aFF4.bat
                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aFF4.bat
                                                                • Size 721B
                                                                • SHA256 4ccac2c28794b4e23c2d11ff044556d3cf49f45de48d000cf77974a18c0ee922
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe.exe
                                                                • Path C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe.exe
                                                                • Size 3.0MB
                                                                • SHA256 91f752c6245968353a2ce985c0c0f44341608689d844798a43a32d1722feb6f1
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe.exe
                                                                • Path C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe.exe
                                                                • Size 2.9MB
                                                                • SHA256 f95a8bc979238f5a839cb5f1800f7b26e9b98cf26f4a01dcc351827bf183bb9c
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe.exe
                                                                • Path C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe.exe
                                                                • Size 2.9MB
                                                                • SHA256 7cb717b474f29fd831a0f732c6d5a329b50e6ec58a90f2c35bb808cffdbab3b0
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe.exe
                                                                • Path C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe.exe
                                                                • Size 3.0MB
                                                                • SHA256 3c80e754f77c3a59c7c4ca246dabca9f6e6f3a8d99a0902def5f42efea660b6f
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe.exe
                                                                • Path C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe.exe
                                                                • Size 3.0MB
                                                                • SHA256 bcfe53c1d4a2cc318147198c71cd34454c12a35bae8e77c08f1c9df7e49a8ad0
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe.exe
                                                                • Path C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe.exe
                                                                • Size 2.9MB
                                                                • SHA256 76433f6e2f93c65969a301e7c66612b874e9396b2bf2cd5ad4d65585b74f2bc6
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe.exe
                                                                • Path C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe.exe
                                                                • Size 2.8MB
                                                                • SHA256 2446ee90f74896c234d236d1ee909bfce52f0c7ca908681f0694cc99ad048953
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe.exe
                                                                • Path C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe.exe
                                                                • Size 3.2MB
                                                                • SHA256 e23343fbe1d2541c2e5aed1056138890b3844fe6b7dff76f78b1da8df56d927b
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe.exe
                                                                • Path C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe.exe
                                                                • Size 3.1MB
                                                                • SHA256 95465415f8c0693c83157bcd018efb7da195f25a78321f58aa7221999c24140d
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe.exe
                                                                • Path C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe.exe
                                                                • Size 3.5MB
                                                                • SHA256 149f052c915117a00131937795edfa38df8897fc1e25c16ab39bc6966b4780c9
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe.exe
                                                                • Path C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe.exe
                                                                • Size 3.4MB
                                                                • SHA256 8a1551b3cdd4a215a235a5a7af277a28bda06841561bb806c6940f8ae9f9d698
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe.exe
                                                                • Path C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe.exe
                                                                • Size 3.4MB
                                                                • SHA256 ebedb6e088ded4e647c831d982295cb5d2970a81a5dc1e9511f2e1e4c6e4580c
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe.exe
                                                                • Path C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe.exe
                                                                • Size 3.4MB
                                                                • SHA256 ed78b94ea57032bab2cab331f6719acff29c5f0aa9db088cb6ee944cd4736045
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe.exe
                                                                • Path C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe.exe
                                                                • Size 3.3MB
                                                                • SHA256 ddcfa973670119c7552ce764c07f456093f84fb59134f06e15be79845bd45696
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe.exe
                                                                • Path C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe.exe
                                                                • Size 3.4MB
                                                                • SHA256 dccd81caf1862eaa2882ec19fa2a5483697f9fca02ed96aa056776cd373598db
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe.exe
                                                                • Path C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe.exe
                                                                • Size 3.3MB
                                                                • SHA256 21231a0040d609c2e028700aca7b0b1add4c93b771faf4c88c09101f747860e8
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe.exe
                                                                • Path C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe.exe
                                                                • Size 3.3MB
                                                                • SHA256 e7eb358a8c4581da21a12700c05d4e8658d58eba7bd49fec260274752456b839
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe.exe
                                                                • Path C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe.exe
                                                                • Size 3.2MB
                                                                • SHA256 430adb88a0b3c816acd668e2932cc51996d25e19011a81c324b9d0aa5bc690ad
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe.exe
                                                                • Path C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe.exe
                                                                • Size 3.2MB
                                                                • SHA256 6c21ae7a894a41b134b367c32752a9697b43b8b744fc8c445581efcccfb09b72
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe.exe
                                                                • Path C:\Users\Admin\AppData\Local\Temp\eacbb24d48ed5e5c3f4e218b6a94aaf9bc6d5452483dd09e4b9cf38590cf62cc.exe.exe
                                                                • Size 3.1MB
                                                                • SHA256 9d11dd98183203a843fd77de893b1aa6b52bc5e82c513eb9835d9519565bc88b
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Logo1_.exe
                                                                • Path C:\Windows\Logo1_.exe
                                                                • Size 32KB
                                                                • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                _desktop.ini
                                                                • Path F:\$RECYCLE.BIN\S-1-5-21-1875162379-3804078649-638427191-1000\_desktop.ini
                                                                • Size 8B
                                                                • SHA256 39da0bdd404cc447f3f3f5f65e587438f746081d5eb0a49c8b8d5304ff66f81e
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                memory/248-8478-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/256-6099-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/344-56-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/364-8383-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/468-8225-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/700-76-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/840-8318-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/1040-8610-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/1068-8231-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/1076-8556-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/1104-8538-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/1124-6107-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/1152-94-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/1244-8248-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/1268-1873-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/1296-8388-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/1344-8586-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/1360-8348-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/1364-8343-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/1392-8393-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/1472-8544-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/1496-1043-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/1560-8288-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/1968-6115-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/2016-6079-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/2192-5594-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/2200-8592-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/2256-8435-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/2280-5610-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/2300-8574-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/2344-8220-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/2452-8580-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/2484-8429-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/2496-8562-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/2568-8298-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/2572-8253-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/2624-8532-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/2680-3690-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/2808-8378-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/2812-8623-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/2812-8629-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/2844-8368-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/3000-8413-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/3004-8273-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/3108-8303-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/3228-8278-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/3308-5602-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/3332-8616-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/3400-8441-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/3444-8226-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/3444-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/3444-3059-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/3444-414-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/3452-8263-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/3488-8403-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/3592-102-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/3796-8293-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/3800-8268-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/3824-8502-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/3948-8308-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/3952-84-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/3964-8418-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/4104-8398-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/4188-8447-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/4216-8328-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/4264-33-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/4360-8622-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/4440-8514-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/4452-8568-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/4472-8508-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/4476-8604-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/4524-8323-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/4532-8526-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/4608-13-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/4608-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/4732-8258-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/4852-8313-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/4916-8243-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/4964-8236-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/5012-8472-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/5028-8358-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/5124-8333-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/5192-8460-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/5248-8363-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/5300-1881-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/5316-8353-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/5404-8338-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/5424-8283-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/5468-8373-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/5476-8598-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/5508-8496-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/5604-8550-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/5616-8466-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/5632-8423-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/5636-8490-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/5696-8408-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/5840-64-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/5860-6087-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/5940-8454-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/5944-42-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/5972-8484-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/6000-23-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/6076-8520-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download