Overview

overview

7

Static

static

3

c265ab7499...a7.exe

windows10-2004-x64

7

c265ab7499...a7.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    24/09/2026, 04:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
  • Size 3.6MB
  • Sample260924-e647rayfmh
  • SHA256 c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 42 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
    "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3768
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7F1E.bat
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4584
      • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
        "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:2344
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a842F.bat
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3348
          • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
            "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:1784
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8577.bat
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:4948
              • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:644
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a87F8.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:988
                  • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                    "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of WriteProcessMemory
                    PID:2536
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A88.bat
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:2988
                      • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                        "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of WriteProcessMemory
                        PID:2824
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D37.bat
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:2268
                          • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                            "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • Suspicious use of WriteProcessMemory
                            PID:3180
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F1C.bat
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:1696
                              • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:1320
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a91DB.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:2644
                                  • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                    "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:4040
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a93FE.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:1036
                                      • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                        "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • Suspicious use of WriteProcessMemory
                                        PID:4556
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a98EF.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • Suspicious use of WriteProcessMemory
                                          PID:3132
                                          • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                            "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • Suspicious use of WriteProcessMemory
                                            PID:4732
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9CE7.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • Suspicious use of WriteProcessMemory
                                              PID:2116
                                              • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious use of WriteProcessMemory
                                                PID:3560
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F0A.bat
                                                  24⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:1060
                                                  • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:2252
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA2A4.bat
                                                      26⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:3088
                                                      • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:4164
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA4C7.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:4372
                                                          • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:3580
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA728.bat
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:4576
                                                              • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:1540
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aADDF.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:824
                                                                  • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:1688
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE8B.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:4308
                                                                      • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:3280
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB159.bat
                                                                          36⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:1364
                                                                          • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:5104
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB31E.bat
                                                                              38⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:4628
                                                                              • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:2744
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB5DE.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:3260
                                                                                  • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:628
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB84F.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:1164
                                                                                      • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:4632
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB6B.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:4604
                                                                                          • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:784
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBCA4.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:876
                                                                                              • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:3192
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD40.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:1788
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:1564
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBDCD.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:3308
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:2168
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE59.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:4564
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:1336
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBEE6.bat
                                                                                                              54⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:4100
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:4332
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBFC1.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:4884
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:1404
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC06D.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:1612
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:2800
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC119.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          PID:4920
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            PID:880
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC1E4.bat
                                                                                                                              62⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              PID:4748
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                PID:2812
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC280.bat
                                                                                                                                  64⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:3736
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                    65⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Drops file in Windows directory
                                                                                                                                    PID:3992
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC31C.bat
                                                                                                                                      66⤵
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:4608
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                        67⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Drops file in Windows directory
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:452
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC399.bat
                                                                                                                                          68⤵
                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                          PID:1108
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                            69⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            PID:1644
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC426.bat
                                                                                                                                              70⤵
                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                              PID:2776
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                71⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:436
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC4F1.bat
                                                                                                                                                  72⤵
                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                  PID:2328
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                    73⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                    PID:2096
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC55E.bat
                                                                                                                                                      74⤵
                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                      PID:4944
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                        75⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:2552
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC5FB.bat
                                                                                                                                                          76⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:4508
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                            77⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            PID:5004
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC678.bat
                                                                                                                                                              78⤵
                                                                                                                                                                PID:2836
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                  79⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  PID:4992
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC6F5.bat
                                                                                                                                                                    80⤵
                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                    PID:3976
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                      81⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      PID:4404
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC781.bat
                                                                                                                                                                        82⤵
                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                        PID:1232
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                          83⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:4156
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA40.bat
                                                                                                                                                                            84⤵
                                                                                                                                                                              PID:1104
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                85⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                PID:2160
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCB5A.bat
                                                                                                                                                                                  86⤵
                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  PID:4196
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                    87⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                    PID:2216
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCBE6.bat
                                                                                                                                                                                      88⤵
                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                      PID:2868
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                        89⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                        PID:4416
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC63.bat
                                                                                                                                                                                          90⤵
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:716
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                            91⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                            PID:3376
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCCF0.bat
                                                                                                                                                                                              92⤵
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:4912
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                93⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                PID:3840
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD7C.bat
                                                                                                                                                                                                  94⤵
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  PID:3140
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                    95⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    PID:464
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCDF9.bat
                                                                                                                                                                                                      96⤵
                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      PID:1484
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                        97⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                        PID:4252
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCE86.bat
                                                                                                                                                                                                          98⤵
                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          PID:3216
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                            99⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                            PID:3176
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF03.bat
                                                                                                                                                                                                              100⤵
                                                                                                                                                                                                                PID:2320
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                  101⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                  PID:60
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF9F.bat
                                                                                                                                                                                                                    102⤵
                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                    PID:4008
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                      103⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                      PID:4504
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD02C.bat
                                                                                                                                                                                                                        104⤵
                                                                                                                                                                                                                          PID:2104
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                            105⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:4052
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD0B9.bat
                                                                                                                                                                                                                              106⤵
                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                              PID:4200
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                107⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                PID:948
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD155.bat
                                                                                                                                                                                                                                  108⤵
                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  PID:3420
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                    109⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:4788
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD1F1.bat
                                                                                                                                                                                                                                      110⤵
                                                                                                                                                                                                                                        PID:2592
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                          111⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          PID:4024
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD2AD.bat
                                                                                                                                                                                                                                            112⤵
                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:2528
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                              113⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:2308
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD378.bat
                                                                                                                                                                                                                                                114⤵
                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                PID:1168
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                  115⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  PID:3644
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD424.bat
                                                                                                                                                                                                                                                    116⤵
                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                    PID:1188
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                      117⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:1400
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD4A1.bat
                                                                                                                                                                                                                                                        118⤵
                                                                                                                                                                                                                                                          PID:3812
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                            119⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            PID:4852
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD52D.bat
                                                                                                                                                                                                                                                              120⤵
                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                              PID:4916
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                121⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                PID:3640
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD5AA.bat
                                                                                                                                                                                                                                                                  122⤵
                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                  PID:3052
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                    123⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    PID:2420
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD627.bat
                                                                                                                                                                                                                                                                      124⤵
                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                      PID:2692
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                        125⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                        PID:1220
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD6A4.bat
                                                                                                                                                                                                                                                                          126⤵
                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                          PID:4816
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                            127⤵
                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                            PID:4168
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD6F2.bat
                                                                                                                                                                                                                                                                              128⤵
                                                                                                                                                                                                                                                                                PID:2068
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                  129⤵
                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                  PID:736
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD76F.bat
                                                                                                                                                                                                                                                                                    130⤵
                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                    PID:4636
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                      131⤵
                                                                                                                                                                                                                                                                                        PID:2920
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD7FC.bat
                                                                                                                                                                                                                                                                                          132⤵
                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                          PID:3676
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                            133⤵
                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            PID:5060
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD889.bat
                                                                                                                                                                                                                                                                                              134⤵
                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                              PID:536
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                135⤵
                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                PID:3532
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD992.bat
                                                                                                                                                                                                                                                                                                  136⤵
                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                  PID:2532
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                    137⤵
                                                                                                                                                                                                                                                                                                      PID:1256
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD9F0.bat
                                                                                                                                                                                                                                                                                                        138⤵
                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                        PID:2524
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                          139⤵
                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                          PID:2448
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA3E.bat
                                                                                                                                                                                                                                                                                                            140⤵
                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                            PID:4432
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                              141⤵
                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                              PID:2340
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA9C.bat
                                                                                                                                                                                                                                                                                                                142⤵
                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                PID:4032
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                  143⤵
                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                  PID:4640
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDAEA.bat
                                                                                                                                                                                                                                                                                                                    144⤵
                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                    PID:1616
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                      145⤵
                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                      PID:4868
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC51.bat
                                                                                                                                                                                                                                                                                                                        146⤵
                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                        PID:2284
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                          147⤵
                                                                                                                                                                                                                                                                                                                            PID:2996
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDD2C.bat
                                                                                                                                                                                                                                                                                                                              148⤵
                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                              PID:5028
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                                149⤵
                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                PID:972
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDED2.bat
                                                                                                                                                                                                                                                                                                                                  150⤵
                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                  PID:2560
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                                    151⤵
                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                    PID:1468
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDF7E.bat
                                                                                                                                                                                                                                                                                                                                      152⤵
                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                      PID:3264
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                                        153⤵
                                                                                                                                                                                                                                                                                                                                          PID:4784
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE039.bat
                                                                                                                                                                                                                                                                                                                                            154⤵
                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                            PID:3248
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                                              155⤵
                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                              PID:3832
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE0E5.bat
                                                                                                                                                                                                                                                                                                                                                156⤵
                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                PID:2816
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                                                  157⤵
                                                                                                                                                                                                                                                                                                                                                    PID:5080
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE1D0.bat
                                                                                                                                                                                                                                                                                                                                                      158⤵
                                                                                                                                                                                                                                                                                                                                                        PID:1760
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                                                          159⤵
                                                                                                                                                                                                                                                                                                                                                            PID:2840
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE24D.bat
                                                                                                                                                                                                                                                                                                                                                              160⤵
                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                              PID:832
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                                                                161⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:2296
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE2D9.bat
                                                                                                                                                                                                                                                                                                                                                                    162⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:376
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                                                                        163⤵
                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                        PID:4392
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE366.bat
                                                                                                                                                                                                                                                                                                                                                                          164⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:5084
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                                                                              165⤵
                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                              PID:4296
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE402.bat
                                                                                                                                                                                                                                                                                                                                                                                166⤵
                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                PID:2436
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                                                                                  167⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:4304
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE48F.bat
                                                                                                                                                                                                                                                                                                                                                                                      168⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:2804
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                                                                                          169⤵
                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                          PID:3724
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE55A.bat
                                                                                                                                                                                                                                                                                                                                                                                            170⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:2276
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                171⤵
                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                PID:1416
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE615.bat
                                                                                                                                                                                                                                                                                                                                                                                                  172⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1856
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    173⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:2376
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE700.bat
                                                                                                                                                                                                                                                                                                                                                                                                        174⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4080
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            175⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:3704
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE7CB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2172
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1224
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE857.bat
                                                                                                                                                                                                                                                                                                                                                                                                                    178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4836
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:592
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE8B5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                        180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4352
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:920
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE942.bat
                                                                                                                                                                                                                                                                                                                                                                                                                            182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4812
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1952
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE9EE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3144
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1712
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEA5B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1812
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3220
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEAD8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                        188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2204
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3440
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEB65.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                            190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3688
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2752
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEBF1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3944
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4596
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEC6E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                      194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2136
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1992
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED49.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                            196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4064
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEDC6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEE62.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEEDF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3136
                                                                                                                                                  • C:\Windows\Logo1_.exe
                                                                                                                                                    C:\Windows\Logo1_.exe
                                                                                                                                                    44⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                    PID:2992
                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                      net stop "Kingsoft AntiVirus Service"
                                                                                                                                                      45⤵
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                      PID:2164
                                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                        46⤵
                                                                                                                                                          PID:3532
                                                                • C:\Windows\Logo1_.exe
                                                                  C:\Windows\Logo1_.exe
                                                                  2⤵
                                                                  • Executes dropped EXE
                                                                  • Enumerates connected drives
                                                                  • Drops file in Program Files directory
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:1100
                                                                  • C:\Windows\SysWOW64\net.exe
                                                                    net stop "Kingsoft AntiVirus Service"
                                                                    3⤵
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:2704
                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                      4⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:4608
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 1012
                                                                    3⤵
                                                                    • Program crash
                                                                    PID:3988
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 1012
                                                                    3⤵
                                                                    • Program crash
                                                                    PID:2108
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1100 -ip 1100
                                                                1⤵
                                                                  PID:4756
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1100 -ip 1100
                                                                  1⤵
                                                                    PID:768

                                                                  Network

                                                                        MITRE ATT&CK Enterprise v16

                                                                        Replay Monitor

                                                                        Loading Replay Monitor...

                                                                        Downloads

                                                                        $$a7F1E.bat
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a7F1E.bat
                                                                        • Size 722B
                                                                        • SHA256 1e6180653c7f840915b28bb6dcb84962af070ca276bd89dffc80c89d12fe5640
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        $$a842F.bat
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a842F.bat
                                                                        • Size 722B
                                                                        • SHA256 0806f3ab3cfcafb59efdcf5c92bfea79d947f47fa1a219948dc15927ad9c9642
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        $$a8577.bat
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a8577.bat
                                                                        • Size 722B
                                                                        • SHA256 d63924695a83e9673d642d8abe84d795cb30d1834bf7b367cc73f7eb7a824579
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        $$a87F8.bat
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a87F8.bat
                                                                        • Size 722B
                                                                        • SHA256 bacb22304e7dbe012bc0e8fda334d4307e227166373e1413e580d9889db639a3
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        $$a8A88.bat
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a8A88.bat
                                                                        • Size 722B
                                                                        • SHA256 7307c4656117fd296ec0465778421fec4e119d39c7718d09027c234ace782c00
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        $$a8D37.bat
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a8D37.bat
                                                                        • Size 722B
                                                                        • SHA256 09ca2b367423dc764254caa7eb125b95aa810f4ec32e46df4141aa5da9cad442
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        $$a8F1C.bat
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a8F1C.bat
                                                                        • Size 722B
                                                                        • SHA256 5e26195f5c5182d89cfa419da4255aba30130ab6134fb2ec71e9d7684d2aa09c
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        $$a91DB.bat
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a91DB.bat
                                                                        • Size 722B
                                                                        • SHA256 7673c893e0a3c1cf199ee13c37962cbbee83187b581c37a3e8ea87f2328dc295
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        $$a93FE.bat
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a93FE.bat
                                                                        • Size 722B
                                                                        • SHA256 1ac32f522321aba0f99e8292f17bf71f7b00b6def6652f6e29d473a058703c40
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        $$a98EF.bat
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a98EF.bat
                                                                        • Size 722B
                                                                        • SHA256 6f83990e2a5c2c0d32fad5d8a72dc9f70b19e5836d9cb7d949828c0919480190
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        $$a9CE7.bat
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a9CE7.bat
                                                                        • Size 722B
                                                                        • SHA256 dd094c4b9b249bfed697a28ea110606de7f7d1b14bcc9114e05615f91415adf0
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        $$a9F0A.bat
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a9F0A.bat
                                                                        • Size 722B
                                                                        • SHA256 eb0b8ed37713463b9933477298b97de42ea772955c78c0f860b810ec430f09fe
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        $$aA2A4.bat
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aA2A4.bat
                                                                        • Size 722B
                                                                        • SHA256 0f1a862a70f3fbb667192dd0990615efd01e0eb9cba85464edd66c99feb353cd
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        $$aA4C7.bat
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aA4C7.bat
                                                                        • Size 722B
                                                                        • SHA256 b8a1b1c18cd26ed9e7697f5a2a9ccc047bb02190236cd779f0aacce61c0e18d4
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        $$aA728.bat
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aA728.bat
                                                                        • Size 722B
                                                                        • SHA256 4a867f0550a7ae8469e8ccc3d33da160f3f511ccb2b9c5d9e80d8333743744ff
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        $$aADDF.bat
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aADDF.bat
                                                                        • Size 722B
                                                                        • SHA256 d48b34f0e28ea5fb51e6579403fd31ba030de146a6b4d1a68dcf9d8b560ca722
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        $$aAE8B.bat
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aAE8B.bat
                                                                        • Size 722B
                                                                        • SHA256 2ca1aa9235ed2b14e6872a8d1dc4cbb8e541557a875b7d25c1c9ecae462510fb
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        $$aB159.bat
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aB159.bat
                                                                        • Size 722B
                                                                        • SHA256 fa04e6b991bff33425dd9690f047db84fbee5a3f052e573e2ecd5e5051ca1308
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        $$aB31E.bat
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aB31E.bat
                                                                        • Size 722B
                                                                        • SHA256 2dfbb14d2dc5907b7797acc7e0a3126cc9255296e109975029ec734724f220e2
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        $$aB5DE.bat
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aB5DE.bat
                                                                        • Size 722B
                                                                        • SHA256 b172f26264e7e63b8099eeefb53ae35b64560086c04ec8ea06313c30185ad0e8
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        $$aB84F.bat
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aB84F.bat
                                                                        • Size 722B
                                                                        • SHA256 cb13d9068a63831dd1f397572509e15cd8d3bf8b0302bf9bfd883e8c269951aa
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Size 3.3MB
                                                                        • SHA256 80e3945de4687171a3b76f6bcf5d1034fdf8129e826035653e034d65617c6e8a
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Size 3.3MB
                                                                        • SHA256 16d5dcc61056857cd361aea1191d279135d7b918782448d2cd8d306114201e78
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Size 3.2MB
                                                                        • SHA256 f7f6e883eb4689e9a266bec922e7bdefd10ca8c96e8cf36c7346f06268e5b203
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Size 3.1MB
                                                                        • SHA256 6c1f4a5f9d016b17489cd746f1ab20524000c460d49e6ccb6f73f909db541a10
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Size 3.6MB
                                                                        • SHA256 e56d6329e8c0fecc3b8ac21a70c37788c8e931b80f1105ff8a2b8efa5cfa816e
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Size 3.6MB
                                                                        • SHA256 ba7ecca71c6ea0eba7624394d57d0045ae3477acc9025e7ca5d58f9784f793bc
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Size 3.2MB
                                                                        • SHA256 a2c1cb5ea0b11c7b86ea04d0752e09f29fe73ed4772cd424a7e7ade5de0c57dd
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Size 3.2MB
                                                                        • SHA256 cfd858bc3b3434019c4a2e443cecf060ae9e6b04f661d8279346995b670ad24b
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Size 3.5MB
                                                                        • SHA256 28a3b2536d0b8dfa5bf4a3d308f7b252c62ded35f92f6ce0b9df12dd7db65e46
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Size 3.5MB
                                                                        • SHA256 9df9076c1b0c00b16bc342a9f53f96e68f8665adaa0c191b8b7e8631328924d0
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Size 3.1MB
                                                                        • SHA256 2d9be13a84d538757e579defe3fa24e3f05b45fedf635a79ba0dae0c888b740d
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Size 3.5MB
                                                                        • SHA256 b1c65b407ae33c08f108e1bd0d698d20dc54a13ae1f48731c0fc8de094fe2e18
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Size 3.4MB
                                                                        • SHA256 7e2425b1c79534060dab4a59f7cb6029c9096408ae42821c25b69b2046f8238a
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Size 3.0MB
                                                                        • SHA256 ad447009e8e82177f7c2e92847deb049cc10512e47e55d5661d4ffe278992e9e
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Size 3.1MB
                                                                        • SHA256 cac44e9df0340de2809fac11e49359086eb54b6bfd672ef846971dfb5f5233f4
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Size 3.4MB
                                                                        • SHA256 5fb2dee3c9951e58611e4d4bc37307846dc9e43e1adcc6f3ce892df98ef220bf
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Size 3.4MB
                                                                        • SHA256 49739ea1c1b5f6e6a677491b408bf1d42ce0cb83362a2a4151ab3ca48e688244
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Size 3.0MB
                                                                        • SHA256 78bc7a0b67792ec6f85211cb3eb83d75eff5ad45fa6e494765c0781c799e7ee7
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Size 3.3MB
                                                                        • SHA256 02c99228c9a88a34c5bcecb76885b8c88df64ef38fdadfbb490861549b5870cf
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Size 3.3MB
                                                                        • SHA256 89049fcadd5686111b3bd23da1b3c2482ea24af64e14896084e064a32f9fabda
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        Logo1_.exe
                                                                        • Path C:\Windows\Logo1_.exe
                                                                        • Size 32KB
                                                                        • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        _desktop.ini
                                                                        • Path F:\$RECYCLE.BIN\S-1-5-21-747854149-4118156852-591593384-1000\_desktop.ini
                                                                        • Size 9B
                                                                        • SHA256 346de4d5debec31c9a445d77ea11610cbefd2c8caf903962fbf17b7ec8847d33
                                                                        • MD5 SHA1 SHA512
                                                                        Submit Download

                                                                        memory/60-2426-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/436-2366-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/452-2358-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/464-2414-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/592-2610-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/628-2299-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/644-44-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/736-2484-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/784-2312-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/880-2345-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/920-2615-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/948-2438-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/972-2534-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/1100-1881-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/1100-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/1100-2300-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/1100-420-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/1220-2474-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/1224-2605-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/1256-2504-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/1320-78-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/1336-2328-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/1400-2458-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/1404-2336-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/1416-2590-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/1468-2539-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/1540-2183-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/1564-2320-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/1644-2362-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/1688-2271-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/1712-2625-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/1784-30-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/1920-2660-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/1952-2620-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/1992-2650-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/2096-2370-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/2132-2661-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/2132-2666-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/2160-2394-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/2168-2324-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/2216-2398-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/2252-1860-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/2296-2565-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/2308-2450-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/2340-2514-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/2344-17-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/2344-23-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/2376-2595-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/2420-2470-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/2448-2509-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/2536-51-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/2552-2374-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/2744-2292-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/2752-2640-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/2800-2340-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/2812-2350-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/2824-62-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/2840-2559-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/2920-2489-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/2992-2346-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/2996-2529-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/3080-2655-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/3176-2422-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/3180-69-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/3192-2316-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/3220-2630-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/3280-2278-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/3376-2406-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/3440-2635-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/3532-2499-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/3560-1379-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/3580-1885-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/3640-2466-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/3644-2454-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/3704-2600-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/3724-2585-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/3768-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/3768-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/3832-2549-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/3840-2410-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/3992-2354-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/4024-2446-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/4040-85-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/4052-2434-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/4156-2390-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/4164-1877-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/4168-2479-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/4252-2418-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/4296-2575-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/4304-2580-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/4332-2332-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/4392-2570-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/4404-2386-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/4416-2402-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/4504-2430-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/4556-791-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/4596-2645-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/4632-2308-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/4640-2519-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/4732-1256-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/4784-2544-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/4788-2442-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/4852-2462-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/4868-2524-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/4992-2382-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/5004-2378-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/5060-2494-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/5080-2554-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/5104-2285-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download