Overview

overview

7

Static

static

3

c546550893...f7.exe

windows10-2004-x64

7

c546550893...f7.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    22/09/2026, 22:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
  • Size 3.7MB
  • Sample260922-2g62datcra
  • SHA256 c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
    "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1944
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a78A6.bat
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1504
      • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
        "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3440
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7C30.bat
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4324
          • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
            "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:5156
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7D0B.bat
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:2204
              • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:5144
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7F4D.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3496
                  • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                    "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:3296
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8306.bat
                      10⤵
                      • Executes a command shell one-liner
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:4788
                      • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                        "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:6012
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8548.bat
                          12⤵
                          • Executes a command shell one-liner
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:5108
                          • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                            "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:668
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a872C.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:3096
                              • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:1460
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a897E.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:1032
                                  • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                    "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • Suspicious use of WriteProcessMemory
                                    PID:5960
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B43.bat
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:5644
                                      • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                        "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • Suspicious use of WriteProcessMemory
                                        PID:4492
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D66.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:3876
                                          • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                            "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • Suspicious use of WriteProcessMemory
                                            PID:616
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F3B.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • Suspicious use of WriteProcessMemory
                                              PID:5404
                                              • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious use of WriteProcessMemory
                                                PID:1124
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a92E4.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:1316
                                                  • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:1548
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a966F.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:4660
                                                      • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:5252
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a99BA.bat
                                                          28⤵
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:5004
                                                          • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:116
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B51.bat
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:3448
                                                              • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:5832
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9DA2.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:6108
                                                                  • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:2612
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA459.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:4480
                                                                      • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:13296
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC39.bat
                                                                          36⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:10844
                                                                          • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:10444
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aACF4.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:10408
                                                                              • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:9416
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB11B.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:9388
                                                                                  • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:9328
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB409.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:9300
                                                                                      • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:7044
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB699.bat
                                                                                          44⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:7000
                                                                                          • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:6928
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB745.bat
                                                                                              46⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:6900
                                                                                              • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:6848
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB7E1.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:6820
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:6772
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB84F.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:6744
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:6696
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB8EB.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:6668
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:6620
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB9C6.bat
                                                                                                              54⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:6592
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:6528
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA52.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:6500
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:6452
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBADF.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:6424
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:6376
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB7B.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:6348
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:6300
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBBF8.bat
                                                                                                                              62⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:6272
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Drops file in Windows directory
                                                                                                                                PID:6228
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC65.bat
                                                                                                                                  64⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  PID:6200
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                    65⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Drops file in Windows directory
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:6152
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBCE2.bat
                                                                                                                                      66⤵
                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                      PID:1968
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                        67⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Drops file in Windows directory
                                                                                                                                        PID:4472
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD5F.bat
                                                                                                                                          68⤵
                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:3508
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                            69⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            PID:1300
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBDDC.bat
                                                                                                                                              70⤵
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:3996
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                71⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:4880
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF44.bat
                                                                                                                                                  72⤵
                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                  PID:4920
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                    73⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:904
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC02E.bat
                                                                                                                                                      74⤵
                                                                                                                                                        PID:11476
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                          75⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:11832
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC167.bat
                                                                                                                                                            76⤵
                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:12524
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                              77⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:13188
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC251.bat
                                                                                                                                                                78⤵
                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                PID:10888
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                  79⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:10236
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC32C.bat
                                                                                                                                                                    80⤵
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:10784
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                      81⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                      PID:8984
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC426.bat
                                                                                                                                                                        82⤵
                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:8716
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                          83⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          PID:8156
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC510.bat
                                                                                                                                                                            84⤵
                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                            PID:7988
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                              85⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              PID:7296
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC5EB.bat
                                                                                                                                                                                86⤵
                                                                                                                                                                                  PID:3816
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                    87⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    PID:6380
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC714.bat
                                                                                                                                                                                      88⤵
                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:6256
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                        89⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:5468
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC81D.bat
                                                                                                                                                                                          90⤵
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:1012
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                            91⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            PID:4420
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA50.bat
                                                                                                                                                                                              92⤵
                                                                                                                                                                                                PID:620
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                  93⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                  PID:11060
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCB3A.bat
                                                                                                                                                                                                    94⤵
                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:2080
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                      95⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      PID:12120
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC54.bat
                                                                                                                                                                                                        96⤵
                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                        PID:12400
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                          97⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          PID:10304
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCDEA.bat
                                                                                                                                                                                                            98⤵
                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                            PID:9888
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                              99⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              PID:8472
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCFCE.bat
                                                                                                                                                                                                                100⤵
                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                PID:7148
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                                  101⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  PID:6336
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD107.bat
                                                                                                                                                                                                                    102⤵
                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                    PID:6408
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                                      103⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      PID:6340
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD1D2.bat
                                                                                                                                                                                                                        104⤵
                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                        PID:6332
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                                          105⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                          PID:4468
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD29D.bat
                                                                                                                                                                                                                            106⤵
                                                                                                                                                                                                                              PID:6156
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                                                107⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                PID:408
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD397.bat
                                                                                                                                                                                                                                  108⤵
                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  PID:4400
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                                                    109⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                    PID:5208
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD424.bat
                                                                                                                                                                                                                                      110⤵
                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                      PID:6564
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                                                        111⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                        PID:3500
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD4C0.bat
                                                                                                                                                                                                                                          112⤵
                                                                                                                                                                                                                                            PID:4380
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                                                              113⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                              PID:4268
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD54C.bat
                                                                                                                                                                                                                                                114⤵
                                                                                                                                                                                                                                                  PID:6004
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                                                                    115⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    PID:3156
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD5D9.bat
                                                                                                                                                                                                                                                      116⤵
                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                      PID:684
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                                                                        117⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                        PID:4868
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD666.bat
                                                                                                                                                                                                                                                          118⤵
                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                          PID:3780
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                                                                            119⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            PID:5588
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD712.bat
                                                                                                                                                                                                                                                              120⤵
                                                                                                                                                                                                                                                                PID:1056
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                                                                                  121⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                  PID:7864
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD7CD.bat
                                                                                                                                                                                                                                                                    122⤵
                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                    PID:64
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                                                                                      123⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      PID:2972
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD8D7.bat
                                                                                                                                                                                                                                                                        124⤵
                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                        PID:2360
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                                                                                          125⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                          PID:5276
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA9C.bat
                                                                                                                                                                                                                                                                            126⤵
                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                            PID:1856
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                                                                                              127⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              PID:5040
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDB09.bat
                                                                                                                                                                                                                                                                                128⤵
                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                PID:4916
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                                                                                                  129⤵
                                                                                                                                                                                                                                                                                    PID:412
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDBD4.bat
                                                                                                                                                                                                                                                                                      130⤵
                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                      PID:2992
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                                                                                                        131⤵
                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                        PID:5436
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC80.bat
                                                                                                                                                                                                                                                                                          132⤵
                                                                                                                                                                                                                                                                                            PID:4784
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                                                                                                              133⤵
                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                              PID:4200
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDD2C.bat
                                                                                                                                                                                                                                                                                                134⤵
                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                PID:1496
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                                                                                                                  135⤵
                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                  PID:888
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDDB9.bat
                                                                                                                                                                                                                                                                                                    136⤵
                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                    PID:2584
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                                                                                                                      137⤵
                                                                                                                                                                                                                                                                                                        PID:3424
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE45.bat
                                                                                                                                                                                                                                                                                                          138⤵
                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                          PID:4576
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                                                                                                                            139⤵
                                                                                                                                                                                                                                                                                                              PID:4336
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDF30.bat
                                                                                                                                                                                                                                                                                                                140⤵
                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                PID:540
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                                                                                                                                  141⤵
                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                  PID:2124
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDFBC.bat
                                                                                                                                                                                                                                                                                                                    142⤵
                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                    PID:4076
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                                                                                                                                      143⤵
                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                      PID:5032
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE049.bat
                                                                                                                                                                                                                                                                                                                        144⤵
                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                        PID:1908
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                                                                                                                                          145⤵
                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                          PID:5772
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE0C6.bat
                                                                                                                                                                                                                                                                                                                            146⤵
                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                            PID:5348
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                                                                                                                                              147⤵
                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                              PID:4000
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE162.bat
                                                                                                                                                                                                                                                                                                                                148⤵
                                                                                                                                                                                                                                                                                                                                  PID:1340
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                                                                                                                                                    149⤵
                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                    PID:1260
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE1EF.bat
                                                                                                                                                                                                                                                                                                                                      150⤵
                                                                                                                                                                                                                                                                                                                                        PID:4864
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                                                                                                                                                          151⤵
                                                                                                                                                                                                                                                                                                                                            PID:4304
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE29B.bat
                                                                                                                                                                                                                                                                                                                                              152⤵
                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                              PID:464
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                                                                                                                                                                153⤵
                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                PID:3336
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE327.bat
                                                                                                                                                                                                                                                                                                                                                  154⤵
                                                                                                                                                                                                                                                                                                                                                    PID:3632
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                                                                                                                                                                      155⤵
                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                      PID:4192
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE3B4.bat
                                                                                                                                                                                                                                                                                                                                                        156⤵
                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                        PID:4536
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                                                                                                                                                                          157⤵
                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                          PID:2564
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE460.bat
                                                                                                                                                                                                                                                                                                                                                            158⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                            PID:2296
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                                                                                                                                                                              159⤵
                                                                                                                                                                                                                                                                                                                                                                PID:4292
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE53B.bat
                                                                                                                                                                                                                                                                                                                                                                  160⤵
                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                  PID:5304
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                                                                                                                                                                                    161⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:11380
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE5E6.bat
                                                                                                                                                                                                                                                                                                                                                                        162⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                        PID:11340
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                                                                                                                                                                                          163⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:11304
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE673.bat
                                                                                                                                                                                                                                                                                                                                                                              164⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:11272
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                                                                                                                                                                                                  165⤵
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  PID:11240
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE700.bat
                                                                                                                                                                                                                                                                                                                                                                                    166⤵
                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                    PID:11212
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                                                                                                                                                                                                      167⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                      PID:11164
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE78C.bat
                                                                                                                                                                                                                                                                                                                                                                                        168⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:11136
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                                                                                                                                                                                                            169⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                            PID:11072
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE809.bat
                                                                                                                                                                                                                                                                                                                                                                                              170⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                              PID:11036
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                171⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                PID:10992
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE896.bat
                                                                                                                                                                                                                                                                                                                                                                                                  172⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                  PID:10968
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    173⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                    PID:10948
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE903.bat
                                                                                                                                                                                                                                                                                                                                                                                                      174⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                      PID:11536
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        175⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:11580
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE990.bat
                                                                                                                                                                                                                                                                                                                                                                                                            176⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                            PID:11600
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              177⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                              PID:11680
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEA6B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                PID:11708
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:11776
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEB36.bat
                                                                                                                                                                                                                                                                                                                                                                                                                    180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:11780
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:11844
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEBC2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                          182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:11868
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:11900
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aECAD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                              184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:11948
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:12044
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED78.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                  186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:12072
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:12152
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEDF5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                        188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:12172
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:12248
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEE62.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                              190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:12292
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:12376
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEEFF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                    192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:12416
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:12472
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF8B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                        194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:12516
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:12576
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF018.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                            196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:12612
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:12816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF085.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:12708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:12756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF102.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:12776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:11656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF1BE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:12840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:12920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF25A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:12940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF306.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:13000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:13040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF3D1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:13080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:13140
                                                                • C:\Windows\Logo1_.exe
                                                                  C:\Windows\Logo1_.exe
                                                                  2⤵
                                                                  • Creates a file in the Startup directory
                                                                  • Executes dropped EXE
                                                                  • Enumerates connected drives
                                                                  • Drops file in Program Files directory
                                                                  • Drops file in Windows directory
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:3568
                                                                  • C:\Windows\SysWOW64\net.exe
                                                                    net stop "Kingsoft AntiVirus Service"
                                                                    3⤵
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:5192
                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                      4⤵
                                                                        PID:1160

                                                                Network

                                                                      MITRE ATT&CK Enterprise v16

                                                                      Replay Monitor

                                                                      Loading Replay Monitor...

                                                                      Downloads

                                                                      $$a78A6.bat
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a78A6.bat
                                                                      • Size 722B
                                                                      • SHA256 2a0afdcd00dfa5e8963933fd443c860b620e3e6ffeaaab3193d0da0475465a4e
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      $$a7C30.bat
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a7C30.bat
                                                                      • Size 722B
                                                                      • SHA256 b57289d43bb7db75da856c7c42493a7b34835cec989529001639e6e48687cfb5
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      $$a7D0B.bat
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a7D0B.bat
                                                                      • Size 722B
                                                                      • SHA256 b891b76ef1b3b763fed1eb8fa9f660555a3484081bd813148e2d5fad1ba42ce3
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      $$a7F4D.bat
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a7F4D.bat
                                                                      • Size 722B
                                                                      • SHA256 bca9d49cf48a2b716f8e55d7fe50ebe033f3e22ebe3d9bb560e0da260774eec6
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      $$a8306.bat
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a8306.bat
                                                                      • Size 722B
                                                                      • SHA256 f9fb2e99a97a0c05f74cedb594382c489ed914b799f7757474a2f459c8ff3836
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      $$a8548.bat
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a8548.bat
                                                                      • Size 722B
                                                                      • SHA256 9dbda0da867cf57fd234932a1b5f22743898f3e0466c26e349d6c400f99906c2
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      $$a872C.bat
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a872C.bat
                                                                      • Size 722B
                                                                      • SHA256 f6c9c9a017c5b1d8b48035768c91f0d4aedc3db75416fd8fd08f0eab9c5f9a29
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      $$a897E.bat
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a897E.bat
                                                                      • Size 722B
                                                                      • SHA256 482d92f86a4339f50630f4128895fda9f1a7313e9739cf9c843a392c77ecdffe
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      $$a8B43.bat
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a8B43.bat
                                                                      • Size 722B
                                                                      • SHA256 21c1e9ed44dcaf11b0949bdfeaca5c8c1fc4d6ef4d3f01b40d791d4c632e6847
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      $$a8D66.bat
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a8D66.bat
                                                                      • Size 722B
                                                                      • SHA256 a6f4d7658fa0a0005523e34a1261a6a17b2e2991d9c78d58123d61b578442019
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      $$a8F3B.bat
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a8F3B.bat
                                                                      • Size 722B
                                                                      • SHA256 f0cc40c65ef9b64cba8c978d70c4b1f926ce2cd687dd3ba7c6e6a75b6a21962a
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      $$a92E4.bat
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a92E4.bat
                                                                      • Size 722B
                                                                      • SHA256 2ab9d0f7ddc435bddc0ba402f50311844d4cb23c2adc4f3f72e77b931f2ceee5
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      $$a966F.bat
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a966F.bat
                                                                      • Size 722B
                                                                      • SHA256 b42400241247ef352b8b23c3ba8e76f01a54d3a953c33e9f81778f3182e363d7
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      $$a99BA.bat
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a99BA.bat
                                                                      • Size 722B
                                                                      • SHA256 5c80bbc2980ccf7d5ba83f4161645183e7d25c7f6361b850062cf1c67314c65b
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      $$a9B51.bat
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a9B51.bat
                                                                      • Size 722B
                                                                      • SHA256 c81b8b840ca249ceee4a2de1bcf5896e8d47245cbc093087c768bbb4d0a7547d
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      $$a9DA2.bat
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a9DA2.bat
                                                                      • Size 722B
                                                                      • SHA256 a76ed164321d08f12874314e5cf3c5547b1a8d2e7101c32aee1a553b60c96e21
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      $$aA459.bat
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aA459.bat
                                                                      • Size 722B
                                                                      • SHA256 25db3dac7e727d598f0863e6401dc28448a1036097546995ad4f2c26e345dbf1
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      $$aAC39.bat
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aAC39.bat
                                                                      • Size 722B
                                                                      • SHA256 ee1ada4b6f32fd84af09e8dd2bab975f3487278e86ac07ac300d68e03e8b1ffd
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      $$aACF4.bat
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aACF4.bat
                                                                      • Size 722B
                                                                      • SHA256 97a03ad0b0138569956de779c7b045f08965ed57104acb9989247d1c593c8f06
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      $$aB11B.bat
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aB11B.bat
                                                                      • Size 722B
                                                                      • SHA256 9a06325e9caa7558c3bf6322c49e2940ec026168a4f8e3240f755bbd0631479a
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      $$aB409.bat
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aB409.bat
                                                                      • Size 722B
                                                                      • SHA256 02947e79873c3a7bb98f3d845b6b46b8e4da75ce563cbe9cdc31e35d7eabad42
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe.exe
                                                                      • Size 3.6MB
                                                                      • SHA256 e4ce4b3ecbce31e20c840e77b14d7ad720b1e1802852db967d9e20983a723d14
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe.exe
                                                                      • Size 3.4MB
                                                                      • SHA256 464daa57fa81b3d1fd0780c23e874ad5ecdc7dd409ab51b3ab8ceb7065cd0340
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe.exe
                                                                      • Size 3.3MB
                                                                      • SHA256 dfee0b7f5a7500927721ca167558bc959cccd8ecd35f30ed2d842be362d65ad8
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe.exe
                                                                      • Size 3.3MB
                                                                      • SHA256 68a4abdeb36b683dfdd6cb9e9a192a1387f44d645d5726680e28be686a445d57
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe.exe
                                                                      • Size 3.2MB
                                                                      • SHA256 5cead7f693ca39ed19d637f3e8e0b405779252dcb6f8a8c2cd7e7290cd0a8a3e
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe.exe
                                                                      • Size 3.2MB
                                                                      • SHA256 3b1dd3b157fc89a2a0bd8c46ba6ccb2a6c8d4d28c2f9df72e3770f1beb696bc3
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe.exe
                                                                      • Size 3.2MB
                                                                      • SHA256 5b0a803bdf8fde9f3f4c2c0d2ef824b3faade0e66e001fab9e9fcd740241afb0
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe.exe
                                                                      • Size 3.1MB
                                                                      • SHA256 c8122b7b84ebcc1e6072cb3a8326bb9085d788b41222b75da2c295f3b9ebcdfd
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe.exe
                                                                      • Size 3.7MB
                                                                      • SHA256 96d4acae8d771aa8dee1c72d20ea9e9cd5c6b6df3aca236230e8050f73a193e7
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe.exe
                                                                      • Size 3.7MB
                                                                      • SHA256 e5f624ac9d128e9c89b336dd9102a868e4c7b76c45fd7e242f723878e5e7d6ef
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe.exe
                                                                      • Size 3.5MB
                                                                      • SHA256 92f63cdbab0225cc142439a15f2f041248ac92c4e561c34ce07e59f8abcb2e00
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe.exe
                                                                      • Size 3.3MB
                                                                      • SHA256 3e7d9ec7365a4eadb65933079cd5aaf0a60a411053424ce0efe5c4d3856260ef
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe.exe
                                                                      • Size 3.3MB
                                                                      • SHA256 879c9b4734d9d039bbef7312e46b7a24c77cc58511742dce889bf62c0f8f73f6
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe.exe
                                                                      • Size 3.6MB
                                                                      • SHA256 75132b4fe2865553a0030a14714fc2c210fee20522851dbe9c0e8ee506318bff
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe.exe
                                                                      • Size 3.6MB
                                                                      • SHA256 b2656d61cd08a72ab8ae33c20d242ad0e4d3e7fac19e61b91f7576d37d392051
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe.exe
                                                                      • Size 3.4MB
                                                                      • SHA256 f20512566926928f83d6b49c8a6ebaf466908cc446e2fa4a85b9675978556028
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe.exe
                                                                      • Size 3.1MB
                                                                      • SHA256 8a45429def5521f3b24465c6cad20313ac984a983029145f5215b0621da2bea2
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe.exe
                                                                      • Size 3.5MB
                                                                      • SHA256 80ac4c4c8c89a2035049fb30308eabbaffcecbd0ee68add969d8a97768db5861
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe.exe
                                                                      • Size 3.5MB
                                                                      • SHA256 1005c08e4571797849a0a4299bc69c58d8b600b8facae7064326463873361f61
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7.exe.exe
                                                                      • Size 3.4MB
                                                                      • SHA256 37d6f45881942460edf953dca2207a56a6904a617a2b057d330bafa3a9eb8689
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      Logo1_.exe
                                                                      • Path C:\Windows\Logo1_.exe
                                                                      • Size 32KB
                                                                      • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      _desktop.ini
                                                                      • Path F:\$RECYCLE.BIN\S-1-5-21-2091445952-3649787497-104050984-1000\_desktop.ini
                                                                      • Size 9B
                                                                      • SHA256 110df0648174cdd0f59f03074b074dd0856b75a6bb090739d1ea81587092e15a
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      memory/116-1921-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/408-10383-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/412-10429-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/616-129-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/668-68-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/888-10444-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/904-6729-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/1124-803-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/1260-10479-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/1300-6234-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/1460-75-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/1548-1435-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/1692-10620-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/1944-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/1944-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/2124-10459-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/2564-10499-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/2612-2958-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/2972-10415-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/3156-10399-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/3296-50-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/3336-10489-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/3424-10449-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/3440-20-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/3500-10391-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/3568-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/3568-125-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/3568-8268-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/3568-2486-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/4000-10474-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/4192-10494-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/4200-10439-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/4268-10395-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/4292-10504-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/4304-10484-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/4336-10454-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/4420-8828-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/4468-10379-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/4472-6223-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/4492-91-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/4868-10403-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/4880-6511-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/5032-10464-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/5040-10424-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/5144-36-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/5156-27-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/5208-10387-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/5252-1914-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/5276-10419-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/5436-10434-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/5468-8538-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/5588-10407-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/5772-10469-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/5832-2020-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/5960-84-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/6012-57-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/6152-6219-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/6228-6215-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/6300-6211-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/6336-10371-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/6340-10375-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/6376-6207-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/6380-8287-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/6452-6203-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/6528-6199-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/6620-6191-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/6696-6187-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/6772-6183-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/6848-6179-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/6928-6175-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/7044-6171-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/7296-8165-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/7864-10411-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/8156-7937-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/8472-10260-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/8984-7771-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/9328-5661-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/9416-5654-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/10236-7494-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/10304-9605-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/10444-5429-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/10948-10539-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/10992-10534-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/11060-8983-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/11072-10529-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/11164-10524-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/11240-10519-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/11304-10514-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/11380-10509-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/11580-10544-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/11656-10610-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/11680-10549-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/11776-10554-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/11832-7093-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/11844-10559-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/11900-10564-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/12044-10569-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/12120-9199-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/12152-10574-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/12248-10580-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/12376-10585-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/12472-10590-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/12576-10595-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/12756-10605-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/12816-10600-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/12920-10615-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/13040-10621-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/13040-10626-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/13188-7303-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download

                                                                      memory/13296-5340-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                      Download