Overview

overview

7

Static

static

3

c265ab7499...a7.exe

windows10-2004-x64

7

c265ab7499...a7.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/09/2026, 04:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
  • Size 3.6MB
  • Sample260924-e647rayfmh
  • SHA256 c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
    "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4664
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a328F.bat
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3756
      • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
        "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:5888
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3704.bat
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2364
          • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
            "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:2380
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a38E8.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:4308
              • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:256
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3B0B.bat
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:3384
                  • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                    "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of WriteProcessMemory
                    PID:4076
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3D3E.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2580
                      • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                        "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of WriteProcessMemory
                        PID:560
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3F03.bat
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:2384
                          • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                            "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:2612
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4107.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:5000
                              • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:2724
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a42FB.bat
                                  16⤵
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:4928
                                  • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                    "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:5964
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a44FE.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:1812
                                      • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                        "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • Suspicious use of WriteProcessMemory
                                        PID:2656
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a46A4.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:3088
                                          • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                            "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • Suspicious use of WriteProcessMemory
                                            PID:3700
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a49E0.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:1264
                                              • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of WriteProcessMemory
                                                PID:5876
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a52BA.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:2860
                                                  • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:3804
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a555A.bat
                                                      26⤵
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:1496
                                                      • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:3772
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a572E.bat
                                                          28⤵
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:2864
                                                          • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:2344
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6335.bat
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:4132
                                                              • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:1964
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6C1E.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:6028
                                                                  • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:5004
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6DF3.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:2792
                                                                      • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:1820
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7352.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:5088
                                                                          • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:5192
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a74F7.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:4412
                                                                              • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:5512
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a767E.bat
                                                                                  40⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:4496
                                                                                  • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:4728
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7882.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:4876
                                                                                      • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:4316
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A18.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:4840
                                                                                          • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:612
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7AF3.bat
                                                                                              46⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:4576
                                                                                              • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:3244
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a83AD.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:5356
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:1800
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8488.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:4880
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:2356
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8572.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:2544
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:2572
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a865D.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:4044
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:708
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8757.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:1340
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:2084
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8841.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:4904
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:956
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a892B.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:2256
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:1988
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a89F6.bat
                                                                                                                              62⤵
                                                                                                                                PID:3632
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:1968
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8AB2.bat
                                                                                                                                    64⤵
                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                    PID:5464
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:5384
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8CC5.bat
                                                                                                                                        66⤵
                                                                                                                                          PID:4232
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                            67⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:1544
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D71.bat
                                                                                                                                              68⤵
                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                              PID:2604
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                69⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:5808
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E3C.bat
                                                                                                                                                  70⤵
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:4332
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                    71⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:4264
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8ED8.bat
                                                                                                                                                      72⤵
                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                      PID:1592
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                        73⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:1796
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F94.bat
                                                                                                                                                          74⤵
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:1644
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                            75⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                            PID:2012
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a904F.bat
                                                                                                                                                              76⤵
                                                                                                                                                                PID:1764
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                  77⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                  PID:4208
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a911B.bat
                                                                                                                                                                    78⤵
                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:1240
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                      79⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      PID:824
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a91B7.bat
                                                                                                                                                                        80⤵
                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:1884
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                          81⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          PID:4852
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9253.bat
                                                                                                                                                                            82⤵
                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                            PID:1596
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                              83⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:1436
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a92EF.bat
                                                                                                                                                                                84⤵
                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                PID:5944
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                  85⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                  PID:4088
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a93AB.bat
                                                                                                                                                                                    86⤵
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:5448
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                      87⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                      PID:912
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9457.bat
                                                                                                                                                                                        88⤵
                                                                                                                                                                                          PID:3140
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                            89⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            PID:6084
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9503.bat
                                                                                                                                                                                              90⤵
                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                              PID:2396
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                91⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                PID:2412
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a95CE.bat
                                                                                                                                                                                                  92⤵
                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                  PID:4572
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                    93⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                    PID:1336
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9699.bat
                                                                                                                                                                                                      94⤵
                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                      PID:4796
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                        95⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        PID:3416
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9754.bat
                                                                                                                                                                                                          96⤵
                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                          PID:5792
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                            97⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                            PID:2872
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a981F.bat
                                                                                                                                                                                                              98⤵
                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:2020
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                99⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                PID:5576
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a98FA.bat
                                                                                                                                                                                                                  100⤵
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  PID:1288
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                    101⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    PID:2800
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a99B6.bat
                                                                                                                                                                                                                      102⤵
                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                      PID:5524
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                        103⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                        PID:6120
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A71.bat
                                                                                                                                                                                                                          104⤵
                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                          PID:3356
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                            105⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:1916
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B2D.bat
                                                                                                                                                                                                                              106⤵
                                                                                                                                                                                                                                PID:1256
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                  107⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  PID:1560
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9BD9.bat
                                                                                                                                                                                                                                    108⤵
                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:1912
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                      109⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                      PID:1424
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9CA4.bat
                                                                                                                                                                                                                                        110⤵
                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                        PID:2888
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                          111⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                          PID:2476
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D50.bat
                                                                                                                                                                                                                                            112⤵
                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                            PID:1960
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                              113⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              PID:676
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9DEC.bat
                                                                                                                                                                                                                                                114⤵
                                                                                                                                                                                                                                                  PID:5632
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                    115⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    PID:4288
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9EE6.bat
                                                                                                                                                                                                                                                      116⤵
                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                      PID:5136
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                        117⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                        PID:4764
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9FA1.bat
                                                                                                                                                                                                                                                          118⤵
                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                          PID:2376
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                            119⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                            PID:4448
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA04D.bat
                                                                                                                                                                                                                                                              120⤵
                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                              PID:4260
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                121⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                PID:2684
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA138.bat
                                                                                                                                                                                                                                                                  122⤵
                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                  PID:4992
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                    123⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    PID:5428
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA1E3.bat
                                                                                                                                                                                                                                                                      124⤵
                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                      PID:3364
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                        125⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                        PID:4384
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA29F.bat
                                                                                                                                                                                                                                                                          126⤵
                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                          PID:4112
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                            127⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                            PID:4080
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA33B.bat
                                                                                                                                                                                                                                                                              128⤵
                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                              PID:1412
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                129⤵
                                                                                                                                                                                                                                                                                  PID:4964
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA3F7.bat
                                                                                                                                                                                                                                                                                    130⤵
                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                    PID:5856
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                      131⤵
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      PID:3760
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA483.bat
                                                                                                                                                                                                                                                                                        132⤵
                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                        PID:3764
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                          133⤵
                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                          PID:4972
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA53F.bat
                                                                                                                                                                                                                                                                                            134⤵
                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                            PID:3112
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                              135⤵
                                                                                                                                                                                                                                                                                                PID:5648
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA5FA.bat
                                                                                                                                                                                                                                                                                                  136⤵
                                                                                                                                                                                                                                                                                                    PID:3952
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                      137⤵
                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                      PID:1640
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA6B6.bat
                                                                                                                                                                                                                                                                                                        138⤵
                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                        PID:5080
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                          139⤵
                                                                                                                                                                                                                                                                                                            PID:4760
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA771.bat
                                                                                                                                                                                                                                                                                                              140⤵
                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                              PID:3104
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                141⤵
                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                PID:5228
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA85C.bat
                                                                                                                                                                                                                                                                                                                  142⤵
                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                  PID:2944
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                    143⤵
                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                    PID:2076
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA936.bat
                                                                                                                                                                                                                                                                                                                      144⤵
                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                      PID:928
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                        145⤵
                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                        PID:5340
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA9E2.bat
                                                                                                                                                                                                                                                                                                                          146⤵
                                                                                                                                                                                                                                                                                                                            PID:3468
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                              147⤵
                                                                                                                                                                                                                                                                                                                                PID:1660
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA7F.bat
                                                                                                                                                                                                                                                                                                                                  148⤵
                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                  PID:200
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                                    149⤵
                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                    PID:968
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB2A.bat
                                                                                                                                                                                                                                                                                                                                      150⤵
                                                                                                                                                                                                                                                                                                                                        PID:1840
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                                          151⤵
                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                          PID:712
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aABF6.bat
                                                                                                                                                                                                                                                                                                                                            152⤵
                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                            PID:2564
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                                              153⤵
                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                              PID:6132
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aACE0.bat
                                                                                                                                                                                                                                                                                                                                                154⤵
                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                PID:744
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                                                  155⤵
                                                                                                                                                                                                                                                                                                                                                    PID:4812
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD7C.bat
                                                                                                                                                                                                                                                                                                                                                      156⤵
                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                      PID:3016
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                                                        157⤵
                                                                                                                                                                                                                                                                                                                                                          PID:1272
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE09.bat
                                                                                                                                                                                                                                                                                                                                                            158⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                            PID:4296
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                                                              159⤵
                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                              PID:4912
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAEB5.bat
                                                                                                                                                                                                                                                                                                                                                                160⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                PID:2696
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                                                                  161⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:5064
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF41.bat
                                                                                                                                                                                                                                                                                                                                                                      162⤵
                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                      PID:700
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                                                                        163⤵
                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                        PID:5172
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB00C.bat
                                                                                                                                                                                                                                                                                                                                                                          164⤵
                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                          PID:920
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                                                                            165⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:1588
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB0B8.bat
                                                                                                                                                                                                                                                                                                                                                                                166⤵
                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                PID:2976
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                                                                                  167⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:2980
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB164.bat
                                                                                                                                                                                                                                                                                                                                                                                      168⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:1704
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                                                                                          169⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:4736
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB210.bat
                                                                                                                                                                                                                                                                                                                                                                                              170⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:5416
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  171⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3168
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB2CC.bat
                                                                                                                                                                                                                                                                                                                                                                                                      172⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                      PID:3052
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        173⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                        PID:3212
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB368.bat
                                                                                                                                                                                                                                                                                                                                                                                                          174⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:908
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              175⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2880
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB404.bat
                                                                                                                                                                                                                                                                                                                                                                                                                176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5728
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5520
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB4C0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                      178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2520
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5124
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB55C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                            180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5992
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3056
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB617.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                  182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5732
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5936
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB694.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                      184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3292
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2820
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB731.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                            186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3864
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2608
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB7BD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                  188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5240
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3008
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB84A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                        190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2960
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1664
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB915.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                            192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:844
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2044
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB992.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA4D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBADA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB67.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBBF3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4656
                                                                  • C:\Windows\Logo1_.exe
                                                                    C:\Windows\Logo1_.exe
                                                                    2⤵
                                                                    • Creates a file in the Startup directory
                                                                    • Executes dropped EXE
                                                                    • Enumerates connected drives
                                                                    • Drops file in Program Files directory
                                                                    • Drops file in Windows directory
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:1228
                                                                    • C:\Windows\SysWOW64\net.exe
                                                                      net stop "Kingsoft AntiVirus Service"
                                                                      3⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:5036
                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                        4⤵
                                                                          PID:4512

                                                                  Network

                                                                        MITRE ATT&CK Enterprise v16

                                                                        Replay Monitor

                                                                        Loading Replay Monitor...

                                                                        Downloads

                                                                        $$a328F.bat
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a328F.bat
                                                                        • Size 722B
                                                                        • SHA256 ae74f4c4a678472bd9f997a6d72c293df68a8609dccbdf649817992596590a10
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        $$a3704.bat
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a3704.bat
                                                                        • Size 722B
                                                                        • SHA256 a500f402d00bc217a65af942ed33dee90eb62df761cea817950c15892715d139
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        $$a38E8.bat
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a38E8.bat
                                                                        • Size 722B
                                                                        • SHA256 c45424ce8f6132de19c6be1c9916b8068327de2be806b0fe166a23f66f500cea
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        $$a3B0B.bat
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a3B0B.bat
                                                                        • Size 722B
                                                                        • SHA256 1525e603d07f88eb4b598b547bdebeedd37e81ac455f0c861197f458c1cfb20c
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        $$a3D3E.bat
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a3D3E.bat
                                                                        • Size 722B
                                                                        • SHA256 ec85af123a96de08fb7e55371819af977f37d49d33c7154fb277f8624d745dda
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        $$a3F03.bat
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a3F03.bat
                                                                        • Size 722B
                                                                        • SHA256 886d8cf61483870daf6f40ba8608e6a5e461a285d7ad91c16bcfcab33e70c813
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        $$a4107.bat
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a4107.bat
                                                                        • Size 722B
                                                                        • SHA256 89ae1d58f82a5f673f2992f5357c78f401ecfd14982c4430ebdd3f8da5a0688a
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        $$a42FB.bat
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a42FB.bat
                                                                        • Size 722B
                                                                        • SHA256 60035d59615ac5b19b468bcfcc0396cbaf7a1c0891855b5fb13e8b5e2159a052
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        $$a44FE.bat
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a44FE.bat
                                                                        • Size 722B
                                                                        • SHA256 a3ba5607ae28da89140c4eda6109a2bb88fc99af7e80fbef8be489ea39edf88a
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        $$a46A4.bat
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a46A4.bat
                                                                        • Size 722B
                                                                        • SHA256 cec17e6a7f9856301d2171bfe82cde0dde401c2c62ee95b0633993c364ce0f72
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        $$a49E0.bat
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a49E0.bat
                                                                        • Size 722B
                                                                        • SHA256 aac6341fa3b42a76251709e9c0ec3459c86e75028bbddf14532a97fdc645ed11
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        $$a52BA.bat
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a52BA.bat
                                                                        • Size 722B
                                                                        • SHA256 eed6558e33bfd55c6c7040748739ccf7ba42f6302c93073558d2851caa39433f
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        $$a555A.bat
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a555A.bat
                                                                        • Size 722B
                                                                        • SHA256 c45b99cfedbe625b9dc0beb32e58da846a34a87cda9a0fa3aa37552a9d61af6c
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        $$a572E.bat
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a572E.bat
                                                                        • Size 722B
                                                                        • SHA256 e6759c504a55d2b9716ab9e19344a1d76d0b139ba979df2ef3e6fae1d9b15037
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        $$a6335.bat
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a6335.bat
                                                                        • Size 722B
                                                                        • SHA256 b62e1a3d3539c99eadce461a3c79bcd26f9c6b72e61e5466251f581dabd862e7
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        $$a6C1E.bat
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a6C1E.bat
                                                                        • Size 722B
                                                                        • SHA256 6c8cb7c34cc108a2eb8a7e15bb398180aecfe978940f8da0c3e0d7c11ee3b3bc
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        $$a6DF3.bat
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a6DF3.bat
                                                                        • Size 722B
                                                                        • SHA256 3b7f381153f9ed38fa7b400a56b157fb04361446e8b41dce1df336fa5858fe9f
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        $$a7352.bat
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a7352.bat
                                                                        • Size 722B
                                                                        • SHA256 9d6e353a18f9783b23602d2cfe24a777e207aeda4459b541b3f53fa9feed4b04
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        $$a74F7.bat
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a74F7.bat
                                                                        • Size 722B
                                                                        • SHA256 9fafef202cb6a26e96b06322337a820606a984645047fb06939b2fb0d64c267f
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        $$a767E.bat
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a767E.bat
                                                                        • Size 722B
                                                                        • SHA256 1b799d549ebe7f3e985b2524075b9a5e07ce4e4e4b0324535e3da0937e24ec66
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        $$a7882.bat
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a7882.bat
                                                                        • Size 722B
                                                                        • SHA256 52196ae14f9efc53d8c2fd9efe898b09f655d89b33f661d727a0e878bf83213f
                                                                        • MD5 SHA1 SHA512 TLSH
                                                                        Submit Download

                                                                        c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Size 3.2MB
                                                                        • SHA256 cfd858bc3b3434019c4a2e443cecf060ae9e6b04f661d8279346995b670ad24b
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Size 3.1MB
                                                                        • SHA256 cac44e9df0340de2809fac11e49359086eb54b6bfd672ef846971dfb5f5233f4
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Size 3.0MB
                                                                        • SHA256 78bc7a0b67792ec6f85211cb3eb83d75eff5ad45fa6e494765c0781c799e7ee7
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Size 3.3MB
                                                                        • SHA256 16d5dcc61056857cd361aea1191d279135d7b918782448d2cd8d306114201e78
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Size 3.2MB
                                                                        • SHA256 f7f6e883eb4689e9a266bec922e7bdefd10ca8c96e8cf36c7346f06268e5b203
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Size 3.2MB
                                                                        • SHA256 a2c1cb5ea0b11c7b86ea04d0752e09f29fe73ed4772cd424a7e7ade5de0c57dd
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Size 3.1MB
                                                                        • SHA256 2d9be13a84d538757e579defe3fa24e3f05b45fedf635a79ba0dae0c888b740d
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Size 3.1MB
                                                                        • SHA256 6c1f4a5f9d016b17489cd746f1ab20524000c460d49e6ccb6f73f909db541a10
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Size 3.0MB
                                                                        • SHA256 ad447009e8e82177f7c2e92847deb049cc10512e47e55d5661d4ffe278992e9e
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Size 3.3MB
                                                                        • SHA256 80e3945de4687171a3b76f6bcf5d1034fdf8129e826035653e034d65617c6e8a
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Size 3.6MB
                                                                        • SHA256 e56d6329e8c0fecc3b8ac21a70c37788c8e931b80f1105ff8a2b8efa5cfa816e
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Size 3.6MB
                                                                        • SHA256 ba7ecca71c6ea0eba7624394d57d0045ae3477acc9025e7ca5d58f9784f793bc
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Size 3.5MB
                                                                        • SHA256 28a3b2536d0b8dfa5bf4a3d308f7b252c62ded35f92f6ce0b9df12dd7db65e46
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Size 3.5MB
                                                                        • SHA256 9df9076c1b0c00b16bc342a9f53f96e68f8665adaa0c191b8b7e8631328924d0
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Size 3.5MB
                                                                        • SHA256 b1c65b407ae33c08f108e1bd0d698d20dc54a13ae1f48731c0fc8de094fe2e18
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Size 3.4MB
                                                                        • SHA256 7e2425b1c79534060dab4a59f7cb6029c9096408ae42821c25b69b2046f8238a
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Size 3.4MB
                                                                        • SHA256 5fb2dee3c9951e58611e4d4bc37307846dc9e43e1adcc6f3ce892df98ef220bf
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Size 3.4MB
                                                                        • SHA256 49739ea1c1b5f6e6a677491b408bf1d42ce0cb83362a2a4151ab3ca48e688244
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Size 3.3MB
                                                                        • SHA256 02c99228c9a88a34c5bcecb76885b8c88df64ef38fdadfbb490861549b5870cf
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7.exe.exe
                                                                        • Size 3.3MB
                                                                        • SHA256 89049fcadd5686111b3bd23da1b3c2482ea24af64e14896084e064a32f9fabda
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        Logo1_.exe
                                                                        • Path C:\Windows\Logo1_.exe
                                                                        • Size 32KB
                                                                        • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                        Submit Download

                                                                        _desktop.ini
                                                                        • Path F:\$RECYCLE.BIN\S-1-5-21-2714045687-1127350534-2056456672-1000\_desktop.ini
                                                                        • Size 9B
                                                                        • SHA256 346de4d5debec31c9a445d77ea11610cbefd2c8caf903962fbf17b7ec8847d33
                                                                        • MD5 SHA1 SHA512
                                                                        Submit Download

                                                                        memory/256-42-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/560-64-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/612-6123-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/676-8309-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/708-8164-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/712-8418-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/824-8224-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/912-8244-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/936-8556-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/956-8174-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/968-8412-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/1228-8082-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/1228-2547-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/1228-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/1228-98-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/1272-8436-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/1336-8259-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/1424-8299-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/1436-8234-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/1544-8194-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/1560-8294-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/1588-8460-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/1640-8375-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/1660-8406-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/1664-8538-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/1796-8209-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/1800-8147-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/1820-6084-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/1916-8289-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/1964-5607-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/1968-8184-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/1988-8179-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/2012-8214-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/2044-8544-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/2076-8394-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/2084-8169-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/2344-4158-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/2356-8152-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/2380-33-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/2412-8254-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/2476-8304-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/2572-8157-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/2608-8526-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/2612-76-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/2656-103-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/2684-8329-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/2724-84-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/2800-8279-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/2816-8562-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/2820-8520-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/2872-8269-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/2880-8490-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/2980-8466-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/3008-8532-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/3056-8508-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/3168-8478-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/3212-8484-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/3244-8142-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/3416-8264-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/3700-211-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/3760-8357-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/3772-1889-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/3804-1881-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/4076-56-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/4080-8345-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/4088-8239-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/4208-8219-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/4264-8204-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/4288-8314-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/4316-6118-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/4384-8339-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/4448-8324-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/4640-8550-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/4664-13-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/4664-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/4728-6112-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/4736-8472-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/4760-8381-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/4764-8319-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/4812-8430-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/4852-8229-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/4912-8442-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/4952-8563-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/4952-8569-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/4964-8351-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/4972-8363-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/5004-5615-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/5064-8448-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/5124-8502-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/5172-8454-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/5192-6092-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/5228-8388-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/5340-8400-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/5384-8189-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/5428-8334-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/5512-6100-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/5520-8496-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/5576-8274-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/5648-8369-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/5808-8199-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/5876-1820-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/5888-23-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/5936-8514-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/5964-94-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/6084-8249-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/6120-8284-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download

                                                                        memory/6132-8424-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                        Download