Overview

overview

7

Static

static

3

7ec5297e10...fc.exe

windows10-2004-x64

7

7ec5297e10...fc.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    16/09/2026, 08:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
  • Size 3.7MB
  • Sample260916-knm4eaxfpf
  • SHA256 7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 42 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
    "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4760
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a95C3.bat
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4868
      • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
        "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:5540
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a97B7.bat
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4076
          • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
            "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:1716
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C99.bat
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2000
              • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:1308
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D83.bat
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:4188
                  • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                    "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:3880
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA062.bat
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:1180
                      • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                        "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:5868
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA256.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:4816
                          • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                            "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of WriteProcessMemory
                            PID:1884
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA4E6.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:4340
                              • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                15⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:4208
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA7B5.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:4784
                                  • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                    "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • Suspicious use of WriteProcessMemory
                                    PID:3312
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA9B8.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:4956
                                      • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                        "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:2904
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC0A.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:2568
                                          • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                            "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • Suspicious use of WriteProcessMemory
                                            PID:5104
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aADCF.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:4832
                                              • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of WriteProcessMemory
                                                PID:5320
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB253.bat
                                                  24⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:2448
                                                  • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:1712
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB65B.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:5572
                                                      • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:5296
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB987.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:5684
                                                          • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:4600
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBBBA.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:1708
                                                              • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:4656
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC0DA.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:6060
                                                                  • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:6128
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC186.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:552
                                                                      • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:5064
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC435.bat
                                                                          36⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:5212
                                                                          • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:5548
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC6C6.bat
                                                                              38⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:3032
                                                                              • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:4352
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC82.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:1836
                                                                                  • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:2268
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD8C.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:1536
                                                                                      • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:1692
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD02C.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:1516
                                                                                          • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:3720
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD164.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:2860
                                                                                              • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:2628
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD29D.bat
                                                                                                  48⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:1840
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:2896
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD349.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:5436
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:5276
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD3F5.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:4060
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:1060
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD462.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:3080
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:2816
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD50E.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:860
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:3528
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD59B.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:2364
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:1260
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD656.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          PID:1896
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            PID:2480
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD6D3.bat
                                                                                                                              62⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              PID:4124
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                PID:4684
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD750.bat
                                                                                                                                  64⤵
                                                                                                                                    PID:5984
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:4176
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD7BD.bat
                                                                                                                                        66⤵
                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:5220
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                          67⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:4652
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD84A.bat
                                                                                                                                            68⤵
                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                            PID:3728
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                              69⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:1268
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD8C7.bat
                                                                                                                                                70⤵
                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                PID:5976
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                  71⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:5768
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD963.bat
                                                                                                                                                    72⤵
                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                    PID:3384
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                      73⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:3348
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA00.bat
                                                                                                                                                        74⤵
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:4872
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                          75⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                          PID:6000
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDABB.bat
                                                                                                                                                            76⤵
                                                                                                                                                              PID:4084
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                77⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:2492
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDB77.bat
                                                                                                                                                                  78⤵
                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                  PID:1852
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                    79⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:5916
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC13.bat
                                                                                                                                                                      80⤵
                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                      PID:2644
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                        81⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                        PID:1236
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDCAF.bat
                                                                                                                                                                          82⤵
                                                                                                                                                                            PID:5176
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                              83⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                              PID:2240
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDD99.bat
                                                                                                                                                                                84⤵
                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                PID:2328
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                  85⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  PID:2672
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE55.bat
                                                                                                                                                                                    86⤵
                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:6068
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                      87⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                      PID:1044
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDF01.bat
                                                                                                                                                                                        88⤵
                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:1800
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                          89⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          PID:5936
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDFAD.bat
                                                                                                                                                                                            90⤵
                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                            PID:1640
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                              91⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                              PID:6044
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE059.bat
                                                                                                                                                                                                92⤵
                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                PID:992
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                                  93⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  PID:5952
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE124.bat
                                                                                                                                                                                                    94⤵
                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:3676
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                                      95⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                      PID:5556
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE1A1.bat
                                                                                                                                                                                                        96⤵
                                                                                                                                                                                                          PID:1980
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                                            97⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            PID:2892
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE25C.bat
                                                                                                                                                                                                              98⤵
                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                              PID:2264
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                                                99⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                PID:2244
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE327.bat
                                                                                                                                                                                                                  100⤵
                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                  PID:2420
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                                                    101⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                    PID:2984
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE3D3.bat
                                                                                                                                                                                                                      102⤵
                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                      PID:2668
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                                                        103⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                        PID:2208
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE48F.bat
                                                                                                                                                                                                                          104⤵
                                                                                                                                                                                                                            PID:5464
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                                                              105⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              PID:2780
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE51B.bat
                                                                                                                                                                                                                                106⤵
                                                                                                                                                                                                                                  PID:1652
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                                                                    107⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                    PID:2200
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE5B8.bat
                                                                                                                                                                                                                                      108⤵
                                                                                                                                                                                                                                        PID:5576
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                                                                          109⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          PID:4332
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE673.bat
                                                                                                                                                                                                                                            110⤵
                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:2940
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                                                                              111⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                              PID:216
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE73E.bat
                                                                                                                                                                                                                                                112⤵
                                                                                                                                                                                                                                                  PID:1868
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                                                                                    113⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                    PID:4300
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE7EA.bat
                                                                                                                                                                                                                                                      114⤵
                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                      PID:1528
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                                                                                        115⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:5392
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE886.bat
                                                                                                                                                                                                                                                          116⤵
                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                          PID:2380
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                                                                                            117⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                            PID:1872
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE942.bat
                                                                                                                                                                                                                                                              118⤵
                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                              PID:4644
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                                                                                                119⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                PID:5284
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE9BF.bat
                                                                                                                                                                                                                                                                  120⤵
                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                  PID:5824
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                                                                                                    121⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    PID:3608
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEA8A.bat
                                                                                                                                                                                                                                                                      122⤵
                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                      PID:3500
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                                                                                                        123⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        PID:4388
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEB94.bat
                                                                                                                                                                                                                                                                          124⤵
                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                          PID:4776
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                                                                                                            125⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            PID:5628
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED49.bat
                                                                                                                                                                                                                                                                              126⤵
                                                                                                                                                                                                                                                                                PID:2400
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                                                                                                                  127⤵
                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                  PID:3328
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEE24.bat
                                                                                                                                                                                                                                                                                    128⤵
                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                    PID:4712
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                                                                                                                      129⤵
                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                      PID:2716
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEEC0.bat
                                                                                                                                                                                                                                                                                        130⤵
                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                        PID:5820
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                                                                                                                          131⤵
                                                                                                                                                                                                                                                                                            PID:3172
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF8B.bat
                                                                                                                                                                                                                                                                                              132⤵
                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                              PID:624
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                                                                                                                                133⤵
                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                PID:6104
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF037.bat
                                                                                                                                                                                                                                                                                                  134⤵
                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                  PID:2616
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                                                                                                                                    135⤵
                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                    PID:5400
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF112.bat
                                                                                                                                                                                                                                                                                                      136⤵
                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                      PID:4716
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                                                                                                                                        137⤵
                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                        PID:4588
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF1ED.bat
                                                                                                                                                                                                                                                                                                          138⤵
                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                          PID:5668
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                                                                                                                                            139⤵
                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                            PID:2524
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF373.bat
                                                                                                                                                                                                                                                                                                              140⤵
                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                              PID:1484
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                                                                                                                                                141⤵
                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                PID:3868
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF49C.bat
                                                                                                                                                                                                                                                                                                                  142⤵
                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                  PID:5544
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                                                                                                                                                    143⤵
                                                                                                                                                                                                                                                                                                                      PID:560
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF603.bat
                                                                                                                                                                                                                                                                                                                        144⤵
                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                        PID:2876
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                                                                                                                                                          145⤵
                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                          PID:4120
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF70D.bat
                                                                                                                                                                                                                                                                                                                            146⤵
                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                            PID:5980
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                                                                                                                                                              147⤵
                                                                                                                                                                                                                                                                                                                                PID:3184
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF7B9.bat
                                                                                                                                                                                                                                                                                                                                  148⤵
                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                  PID:1720
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                                                                                                                                                                    149⤵
                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                    PID:1352
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF865.bat
                                                                                                                                                                                                                                                                                                                                      150⤵
                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                      PID:2272
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                                                                                                                                                                        151⤵
                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                        PID:3316
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF901.bat
                                                                                                                                                                                                                                                                                                                                          152⤵
                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                          PID:2300
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                                                                                                                                                                            153⤵
                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                            PID:2236
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF99D.bat
                                                                                                                                                                                                                                                                                                                                              154⤵
                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                              PID:540
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                                                                                                                                                                                155⤵
                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                PID:1960
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFA88.bat
                                                                                                                                                                                                                                                                                                                                                  156⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:1152
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                                                                                                                                                                                    157⤵
                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                    PID:1860
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFBD0.bat
                                                                                                                                                                                                                                                                                                                                                      158⤵
                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                      PID:2996
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                                                                                                                                                                                        159⤵
                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                        PID:1772
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFD18.bat
                                                                                                                                                                                                                                                                                                                                                          160⤵
                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                          PID:968
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                                                                                                                                                                                            161⤵
                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                            PID:5472
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFE22.bat
                                                                                                                                                                                                                                                                                                                                                              162⤵
                                                                                                                                                                                                                                                                                                                                                                PID:5588
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                                                                                                                                                                                                  163⤵
                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                  PID:5972
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFECD.bat
                                                                                                                                                                                                                                                                                                                                                                    164⤵
                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                    PID:2020
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                                                                                                                                                                                                      165⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:3132
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFF4A.bat
                                                                                                                                                                                                                                                                                                                                                                          166⤵
                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                          PID:2316
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                                                                                                                                                                                                            167⤵
                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                            PID:5828
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFFD7.bat
                                                                                                                                                                                                                                                                                                                                                                              168⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                              PID:5424
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                                                                                                                                                                                                                169⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:5992
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA2.bat
                                                                                                                                                                                                                                                                                                                                                                                    170⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                    PID:5036
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                                                                                                                                                                                                                      171⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                      PID:220
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a110.bat
                                                                                                                                                                                                                                                                                                                                                                                        172⤵
                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                        PID:4668
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                                                                                                                                                                                                                          173⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                          PID:4348
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1BB.bat
                                                                                                                                                                                                                                                                                                                                                                                            174⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:5892
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                175⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                PID:320
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a258.bat
                                                                                                                                                                                                                                                                                                                                                                                                  176⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:1704
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      177⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4944
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E4.bat
                                                                                                                                                                                                                                                                                                                                                                                                          178⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2428
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              179⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4620
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a381.bat
                                                                                                                                                                                                                                                                                                                                                                                                                180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5728
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6008
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a41D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                    182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3260
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1592
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4B9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                        184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2544
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3884
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a565.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:700
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1100
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a620.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                      188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3492
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3452
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6CC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                          190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6076
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4780
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a749.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                  192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4844
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5152
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                      194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4948
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5508
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a872.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                          196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1040
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2852
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8FF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                              198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4272
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a99B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA76.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB70.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5744
                                                                                                                                                • C:\Windows\Logo1_.exe
                                                                                                                                                  C:\Windows\Logo1_.exe
                                                                                                                                                  46⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                  PID:3196
                                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                                    net stop "Kingsoft AntiVirus Service"
                                                                                                                                                    47⤵
                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                    PID:3976
                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                      48⤵
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:5692
                                                        • C:\Windows\Logo1_.exe
                                                          C:\Windows\Logo1_.exe
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • Enumerates connected drives
                                                          • Drops file in Program Files directory
                                                          • Drops file in Windows directory
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:4880
                                                          • C:\Windows\SysWOW64\net.exe
                                                            net stop "Kingsoft AntiVirus Service"
                                                            3⤵
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:4808
                                                            • C:\Windows\SysWOW64\net1.exe
                                                              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                              4⤵
                                                                PID:5652
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 4880 -s 952
                                                              3⤵
                                                              • Program crash
                                                              PID:4332
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4880 -ip 4880
                                                          1⤵
                                                            PID:1232

                                                          Network

                                                                MITRE ATT&CK Enterprise v16

                                                                Replay Monitor

                                                                Loading Replay Monitor...

                                                                Downloads

                                                                $$a95C3.bat
                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a95C3.bat
                                                                • Size 722B
                                                                • SHA256 39409706aded51d8b36f0c548555b605ce7c9ddcd6c53e3d060468f45ad72c92
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                $$a97B7.bat
                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a97B7.bat
                                                                • Size 722B
                                                                • SHA256 790c697cb079e54f1e9c3607efaa16fc5fa0b5f548be1937e1be5cdb453e4a78
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                $$a9C99.bat
                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a9C99.bat
                                                                • Size 722B
                                                                • SHA256 d99a888b2d2942f2d92e44f5c93ee8da87bd419a71750f9007f6b8186170dcc1
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                $$a9D83.bat
                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a9D83.bat
                                                                • Size 722B
                                                                • SHA256 fc41b9593707632f96fd588f405469836102fc70e5460d11c0679a14738b1667
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                $$aA062.bat
                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aA062.bat
                                                                • Size 722B
                                                                • SHA256 08a9abff7e1558bb935f9ecd0ef5ddc66973c8f97396bcbd305c4eb0ad20cd04
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                $$aA256.bat
                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aA256.bat
                                                                • Size 722B
                                                                • SHA256 ad6b940fdae1246162e9f0774d984750170772e760f716f8b110b61e40387528
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                $$aA4E6.bat
                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aA4E6.bat
                                                                • Size 722B
                                                                • SHA256 90f737d8584664e1e701d764a0b4b9a55ae172b89303f22e7c95fb2cc2d8a226
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                $$aA7B5.bat
                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aA7B5.bat
                                                                • Size 722B
                                                                • SHA256 894357ddc249b3c37ac6f4c29ccb5a25292e768e8e466ca45f2eb3506c5ee0a4
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                $$aA9B8.bat
                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aA9B8.bat
                                                                • Size 722B
                                                                • SHA256 e2d4ca4f47f3d60a4a6f55d69eb009123781d3bce2985bf31274a6b0e9057930
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                $$aAC0A.bat
                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aAC0A.bat
                                                                • Size 722B
                                                                • SHA256 9250012ae4fb058cd60f12227dfa93b125b2923b50ee53fd7d525adffb73307b
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                $$aADCF.bat
                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aADCF.bat
                                                                • Size 722B
                                                                • SHA256 5908662072c7714e4a6171627425f7f44f447544d876a1a3e782a7e72d6981db
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                $$aB253.bat
                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aB253.bat
                                                                • Size 722B
                                                                • SHA256 44c48c0bfe85c54919197906d4af56078a6f54a2e78077c2a2a2d6fb4b83dd99
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                $$aB65B.bat
                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aB65B.bat
                                                                • Size 722B
                                                                • SHA256 148a6cf7b033a49b129a838d99b22face469a72bc18861baf98b45f49a028eb1
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                $$aB987.bat
                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aB987.bat
                                                                • Size 722B
                                                                • SHA256 60a9d2897160992f863a7df4a2ec316b0e1c9717495913163f9964f22534511f
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                $$aBBBA.bat
                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aBBBA.bat
                                                                • Size 722B
                                                                • SHA256 ee10fe3296f6404c03894b35213363c615250f38fb0bf9135c181dd7565f9c2e
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                $$aC0DA.bat
                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aC0DA.bat
                                                                • Size 722B
                                                                • SHA256 780086540c506ff99e23e52cfbc55df228de3cd159b60b908b515d6ff9fdf1a9
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                $$aC186.bat
                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aC186.bat
                                                                • Size 722B
                                                                • SHA256 117994514df868395e72d3dcd70758ab981d1b1b709807e1f4d02fd06539c4ea
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                $$aC435.bat
                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aC435.bat
                                                                • Size 722B
                                                                • SHA256 bfcb714b5280666be8ac8f998acbf5fcaaf13ccbbecb558c365f881adc7875cb
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                $$aC6C6.bat
                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aC6C6.bat
                                                                • Size 722B
                                                                • SHA256 17075982ed180d9014adcbfaa69cd92fe15c726d506d2a916bc0def2e12001ed
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                $$aCC82.bat
                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aCC82.bat
                                                                • Size 722B
                                                                • SHA256 7d27ceba8199ce5750f109f3c148fea2800dfc7fe01cf2b35a34b666c4fa95d2
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                $$aCD8C.bat
                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aCD8C.bat
                                                                • Size 722B
                                                                • SHA256 1d0979fbe579d517329a01541b8fb979693cdb0a42f30c8f9bf04f4d289c3e04
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                • Path C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe
                                                                • Size 3.2MB
                                                                • SHA256 1fb7187776826d92823f969ec20cf9680096908c28fa8553008da8f332e19851
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe.exe
                                                                • Path C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe.exe
                                                                • Size 3.5MB
                                                                • SHA256 003402f8f54462e85843063d3b7d284c7d0f8caf796e348a216d868f9878eb7f
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe.exe
                                                                • Path C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe.exe
                                                                • Size 3.3MB
                                                                • SHA256 983525fb84b502220ebab6d658d9a043469e85f8ab5be1f695447300aa2fe8f3
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe.exe
                                                                • Path C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe.exe
                                                                • Size 3.3MB
                                                                • SHA256 1044bea0de82e4d9860dd667f77a7e61316b317d76cf7690aa13c8e482a74c72
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe.exe
                                                                • Path C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe.exe
                                                                • Size 3.2MB
                                                                • SHA256 480e0031fb430c05680e1074aa24b645e6e395756a020e268e024a54e5792c7b
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe.exe
                                                                • Path C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe.exe
                                                                • Size 3.1MB
                                                                • SHA256 2af3f65c28064d70705f363ab551cd7e1ad4ad06994f4c979677b7c1e7a4b5c1
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe.exe
                                                                • Path C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe.exe
                                                                • Size 3.7MB
                                                                • SHA256 71d3f1149cc438b02b45634ee2c1a5bc678a2250623a2abed21c8d7543f95ccf
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe.exe
                                                                • Path C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe.exe
                                                                • Size 3.6MB
                                                                • SHA256 bf33a34e9d329249e03d9b790c65398151d8412eca04d62840f21b0cfe139b3d
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe.exe
                                                                • Path C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe.exe
                                                                • Size 3.6MB
                                                                • SHA256 6791dd9f207655230c17910faa7f0eb8ebd55a2a8d192712fdff1b1ab6c11150
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe.exe
                                                                • Path C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe.exe
                                                                • Size 3.4MB
                                                                • SHA256 d203039b76b5410354d996c968477d21e1e6d9c127f5dff835ed41e1269ca18e
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe.exe
                                                                • Path C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe.exe
                                                                • Size 3.3MB
                                                                • SHA256 595dc8640ef6a8d34d0fef86ea8a7b3ec9db49a0abdb17df4059d1a38676b18a
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe.exe
                                                                • Path C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe.exe
                                                                • Size 3.2MB
                                                                • SHA256 b0eb814a4d4ba16e823d950b9c7f9f334053cb6e53a84bfb964c09d3201b19b3
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe.exe
                                                                • Path C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe.exe
                                                                • Size 3.1MB
                                                                • SHA256 67cdca3e57804f11761d3437243eff37f6c1f43d7957f16e1ea58079f64ad2cf
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe.exe
                                                                • Path C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe.exe
                                                                • Size 3.5MB
                                                                • SHA256 fcc67df9c70746559b658f764fc96b5edf045617b90a6a436b6efaac5a4a73d6
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe.exe
                                                                • Path C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe.exe
                                                                • Size 3.6MB
                                                                • SHA256 4a88e5276c0e79217140896768b38346535eeeef25c70b5180c0b20940023e8d
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe.exe
                                                                • Path C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe.exe
                                                                • Size 3.3MB
                                                                • SHA256 66e6be7bafa61e3d99cb6967e672487402cae77f22f7610addb7608d59b69316
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe.exe
                                                                • Path C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe.exe
                                                                • Size 3.5MB
                                                                • SHA256 877a9ef2748d43c0acd1e03bb2c76c8cb2e04c550b85082ea7f78af9e7656409
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe.exe
                                                                • Path C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe.exe
                                                                • Size 3.1MB
                                                                • SHA256 c3c38800956b5b8aab0ff01955ccc41fb06ee9c206969b83769b8abc70bc306b
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe.exe
                                                                • Path C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe.exe
                                                                • Size 3.4MB
                                                                • SHA256 15c704dde61942f293226970813fe9951c4df8196104abcc1e0f6dee25cbf90a
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe.exe
                                                                • Path C:\Users\Admin\AppData\Local\Temp\7ec5297e10713e98ceb19fa6d5fe3ef6131e6e56f19d44279dc8242d364eeefc.exe.exe
                                                                • Size 3.4MB
                                                                • SHA256 3db2335cb81a68c4a8c165e70c71350e78dd754dbb266bf8ec56a47161f0913a
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Logo1_.exe
                                                                • Path C:\Windows\Logo1_.exe
                                                                • Size 32KB
                                                                • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                _desktop.ini
                                                                • Path F:\$RECYCLE.BIN\S-1-5-21-2091445952-3649787497-104050984-1000\_desktop.ini
                                                                • Size 9B
                                                                • SHA256 adce21c38863e3719070b76cc57d41c4a6461464168032427c8b59beb6ce354c
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                memory/216-2392-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/220-2535-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/320-2545-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/560-2464-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/904-2616-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/904-2621-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/1044-2344-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/1060-2274-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/1100-2575-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/1236-2332-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/1260-2286-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/1268-2308-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/1308-37-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/1308-1543-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/1320-2605-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/1352-2479-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/1592-2565-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/1692-2246-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/1712-1550-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/1716-30-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/1772-2505-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/1860-2500-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/1872-2404-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/1884-68-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/1960-2495-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/2096-2610-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/2200-2384-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/2208-2376-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/2236-2490-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/2240-2336-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/2244-2368-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/2268-2241-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/2480-2290-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/2492-2324-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/2524-2454-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/2628-2261-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/2672-2340-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/2716-2429-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/2780-2380-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/2816-2278-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/2852-2600-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/2892-2364-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/2896-2265-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/2904-92-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/2984-2372-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/3132-2520-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/3172-2434-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/3184-2474-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/3196-2295-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/3196-2254-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/3312-85-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/3316-2485-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/3328-2424-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/3348-2316-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/3452-2580-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/3528-2282-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/3608-2412-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/3720-2256-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/3868-2459-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/3880-50-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/3884-2570-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/4120-2469-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/4176-2299-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/4208-76-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/4208-75-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/4300-2396-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/4332-2388-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/4348-2540-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/4352-2234-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/4388-2416-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/4588-2449-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/4600-1867-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/4620-2555-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/4652-2304-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/4656-1935-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/4684-2294-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/4760-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/4760-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/4780-2585-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/4880-2248-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/4880-1931-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/4880-126-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/4944-2550-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/5064-2056-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/5104-132-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/5152-2590-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/5276-2270-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/5284-2408-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/5296-1754-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/5320-1196-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/5392-2400-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/5400-2444-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/5472-2510-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/5508-2595-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/5540-20-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/5540-16-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/5548-2085-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/5556-2360-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/5628-2420-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/5768-2312-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/5776-2615-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/5828-2525-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/5868-57-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/5916-2328-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/5936-2348-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/5952-2356-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/5972-2515-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/5992-2530-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/6000-2320-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/6008-2560-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/6044-2352-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/6104-2439-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/6128-1953-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/6128-2266-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download

                                                                memory/6128-1942-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                Download