Overview

overview

7

Static

static

3

a26425f05a...82.exe

windows10-2004-x64

7

a26425f05a...82.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    142s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/09/2026, 04:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
  • Size 3.8MB
  • Sample260924-e65hhsea88
  • SHA256 a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 42 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
    "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5688
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA426.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3804
      • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
        "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:856
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA7DF.bat
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4608
          • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
            "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4188
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA9F2.bat
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:5824
              • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:5508
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC15.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4820
                  • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                    "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of WriteProcessMemory
                    PID:4628
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE18.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4088
                      • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                        "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:6100
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAFFD.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3684
                          • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                            "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of WriteProcessMemory
                            PID:4688
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB200.bat
                              14⤵
                              • Executes a command shell one-liner
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:6088
                              • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                15⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:3292
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB404.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:3208
                                  • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                    "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:5076
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB608.bat
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:2800
                                      • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                        "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:3172
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB80B.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • Suspicious use of WriteProcessMemory
                                          PID:3744
                                          • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                            "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • Suspicious use of WriteProcessMemory
                                            PID:4976
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB19.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:3356
                                              • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious use of WriteProcessMemory
                                                PID:2832
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC24C.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:4756
                                                  • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:2032
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC3B4.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:1120
                                                      • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:4368
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA6A.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:1740
                                                          • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:3236
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF9B.bat
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:1616
                                                              • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:1996
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD3F0.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:5296
                                                                  • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:3000
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD586.bat
                                                                      34⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:6004
                                                                      • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:5748
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD8E2.bat
                                                                          36⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:3084
                                                                          • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:5352
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA87.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:5344
                                                                              • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:4656
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC4D.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:3176
                                                                                  • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:1752
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDDC4.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:4168
                                                                                      • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:3080
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE7F.bat
                                                                                          44⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:3436
                                                                                          • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:1468
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDF5A.bat
                                                                                              46⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:1596
                                                                                              • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:4220
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE025.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:4892
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:6116
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE0E0.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:2476
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:3012
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE18C.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:1620
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:4432
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE267.bat
                                                                                                              54⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:1808
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:5356
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE323.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:5060
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:3096
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE3DE.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:4632
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:4192
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE49A.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          PID:2636
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            PID:2024
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE565.bat
                                                                                                                              62⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              PID:4140
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Drops file in Windows directory
                                                                                                                                PID:1300
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE601.bat
                                                                                                                                  64⤵
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:6084
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                    65⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:572
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE69D.bat
                                                                                                                                      66⤵
                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                      PID:2920
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                        67⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        PID:6036
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE749.bat
                                                                                                                                          68⤵
                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                          PID:1536
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                            69⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            PID:5576
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE7F5.bat
                                                                                                                                              70⤵
                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                              PID:5512
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                71⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:5028
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE8B0.bat
                                                                                                                                                  72⤵
                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:3044
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                    73⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                    PID:2864
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE94D.bat
                                                                                                                                                      74⤵
                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                      PID:5972
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                        75⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                        PID:1956
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE9E9.bat
                                                                                                                                                          76⤵
                                                                                                                                                            PID:3440
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                              77⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:3848
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEAB4.bat
                                                                                                                                                                78⤵
                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                PID:2576
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                  79⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  PID:2776
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEB7F.bat
                                                                                                                                                                    80⤵
                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                    PID:3588
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                      81⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      PID:3388
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEC2B.bat
                                                                                                                                                                        82⤵
                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                        PID:1380
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                          83⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:2392
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aECE7.bat
                                                                                                                                                                            84⤵
                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                            PID:3772
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                              85⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:2544
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEDA2.bat
                                                                                                                                                                                86⤵
                                                                                                                                                                                  PID:1312
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                    87⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                    PID:5280
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEE7D.bat
                                                                                                                                                                                      88⤵
                                                                                                                                                                                        PID:1428
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                          89⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:5072
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF19.bat
                                                                                                                                                                                            90⤵
                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                            PID:2572
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                              91⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              PID:3240
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEFB5.bat
                                                                                                                                                                                                92⤵
                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                PID:2552
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                  93⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  PID:5928
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF071.bat
                                                                                                                                                                                                    94⤵
                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:2804
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                      95⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                      PID:5440
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF12C.bat
                                                                                                                                                                                                        96⤵
                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                        PID:4144
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                          97⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          PID:5492
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF1D8.bat
                                                                                                                                                                                                            98⤵
                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                            PID:5436
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                              99⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                              PID:2936
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF284.bat
                                                                                                                                                                                                                100⤵
                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                PID:5756
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                                  101⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  PID:980
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF34F.bat
                                                                                                                                                                                                                    102⤵
                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                    PID:4716
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                                      103⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                      PID:5100
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF3DC.bat
                                                                                                                                                                                                                        104⤵
                                                                                                                                                                                                                          PID:2256
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                                            105⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:5484
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF488.bat
                                                                                                                                                                                                                              106⤵
                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              PID:2288
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                                                107⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                PID:5368
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF534.bat
                                                                                                                                                                                                                                  108⤵
                                                                                                                                                                                                                                    PID:824
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                                                      109⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      PID:1372
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF5EF.bat
                                                                                                                                                                                                                                        110⤵
                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                        PID:4356
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                                                          111⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          PID:2980
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF69B.bat
                                                                                                                                                                                                                                            112⤵
                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                            PID:2844
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                                                              113⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:6016
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF776.bat
                                                                                                                                                                                                                                                114⤵
                                                                                                                                                                                                                                                  PID:2996
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                                                                    115⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    PID:5528
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF822.bat
                                                                                                                                                                                                                                                      116⤵
                                                                                                                                                                                                                                                        PID:4340
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                                                                          117⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          PID:4748
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF8AE.bat
                                                                                                                                                                                                                                                            118⤵
                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            PID:1744
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                                                                              119⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              PID:792
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF9A8.bat
                                                                                                                                                                                                                                                                120⤵
                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                PID:5300
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                                                                                  121⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                  PID:200
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFA35.bat
                                                                                                                                                                                                                                                                    122⤵
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    PID:2308
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                                                                                      123⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      PID:1052
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFB10.bat
                                                                                                                                                                                                                                                                        124⤵
                                                                                                                                                                                                                                                                          PID:944
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                                                                                            125⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                            PID:5728
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFBAC.bat
                                                                                                                                                                                                                                                                              126⤵
                                                                                                                                                                                                                                                                                PID:1476
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                                                                                                  127⤵
                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                  PID:3520
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFC48.bat
                                                                                                                                                                                                                                                                                    128⤵
                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                    PID:4588
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                                                                                                      129⤵
                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                      PID:2964
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFCE4.bat
                                                                                                                                                                                                                                                                                        130⤵
                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                        PID:2524
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                                                                                                          131⤵
                                                                                                                                                                                                                                                                                            PID:6028
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFD81.bat
                                                                                                                                                                                                                                                                                              132⤵
                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                              PID:2404
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                                                                                                                133⤵
                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                PID:1392
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFE0D.bat
                                                                                                                                                                                                                                                                                                  134⤵
                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                  PID:2960
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                                                                                                                    135⤵
                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                    PID:1628
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFEB9.bat
                                                                                                                                                                                                                                                                                                      136⤵
                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                      PID:2100
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                                                                                                                        137⤵
                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                        PID:3624
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFF46.bat
                                                                                                                                                                                                                                                                                                          138⤵
                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                          PID:5472
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                                                                                                                            139⤵
                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                            PID:2396
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1.bat
                                                                                                                                                                                                                                                                                                              140⤵
                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                              PID:2764
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                                                                                                                                141⤵
                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                PID:472
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D.bat
                                                                                                                                                                                                                                                                                                                  142⤵
                                                                                                                                                                                                                                                                                                                    PID:3184
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                                                                                                                                      143⤵
                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                      PID:5000
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a12A.bat
                                                                                                                                                                                                                                                                                                                        144⤵
                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                        PID:4924
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                                                                                                                                          145⤵
                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                          PID:5960
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1C6.bat
                                                                                                                                                                                                                                                                                                                            146⤵
                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                            PID:5244
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                                                                                                                                              147⤵
                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                              PID:5780
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a263.bat
                                                                                                                                                                                                                                                                                                                                148⤵
                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                PID:3244
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                                                                                                                                                  149⤵
                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                  PID:1792
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2FF.bat
                                                                                                                                                                                                                                                                                                                                    150⤵
                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                    PID:4752
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                                                                                                                                                      151⤵
                                                                                                                                                                                                                                                                                                                                        PID:3120
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a39B.bat
                                                                                                                                                                                                                                                                                                                                          152⤵
                                                                                                                                                                                                                                                                                                                                            PID:5640
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                                                                                                                                                              153⤵
                                                                                                                                                                                                                                                                                                                                                PID:5696
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a447.bat
                                                                                                                                                                                                                                                                                                                                                  154⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                  PID:564
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                                                                                                                                                                    155⤵
                                                                                                                                                                                                                                                                                                                                                      PID:2588
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4F3.bat
                                                                                                                                                                                                                                                                                                                                                        156⤵
                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                        PID:4908
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                                                                                                                                                                          157⤵
                                                                                                                                                                                                                                                                                                                                                            PID:4568
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a57F.bat
                                                                                                                                                                                                                                                                                                                                                              158⤵
                                                                                                                                                                                                                                                                                                                                                                PID:3416
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                                                                                                                                                                                  159⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:5320
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a63B.bat
                                                                                                                                                                                                                                                                                                                                                                      160⤵
                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                      PID:696
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                                                                                                                                                                                        161⤵
                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                        PID:3268
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6C8.bat
                                                                                                                                                                                                                                                                                                                                                                          162⤵
                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                          PID:5424
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                                                                                                                                                                                            163⤵
                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                            PID:4452
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a754.bat
                                                                                                                                                                                                                                                                                                                                                                              164⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:2008
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                                                                                                                                                                                                  165⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                  PID:3336
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7D1.bat
                                                                                                                                                                                                                                                                                                                                                                                    166⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                    PID:2428
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                                                                                                                                                                                                      167⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                      PID:3552
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a86D.bat
                                                                                                                                                                                                                                                                                                                                                                                        168⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                        PID:5940
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                                                                                                                                                                                                          169⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                          PID:4904
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a90A.bat
                                                                                                                                                                                                                                                                                                                                                                                            170⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                            PID:2188
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                                                                                                                                                                                                              171⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                              PID:4680
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A6.bat
                                                                                                                                                                                                                                                                                                                                                                                                172⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                PID:5752
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  173⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                  PID:5140
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA42.bat
                                                                                                                                                                                                                                                                                                                                                                                                    174⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4932
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      175⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                      PID:3916
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aACF.bat
                                                                                                                                                                                                                                                                                                                                                                                                        176⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4480
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          177⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4384
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB5B.bat
                                                                                                                                                                                                                                                                                                                                                                                                              178⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2556
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4572
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                  180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2128
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1948
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC94.bat
                                                                                                                                                                                                                                                                                                                                                                                                                        182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5612
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4408
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD30.bat
                                                                                                                                                                                                                                                                                                                                                                                                                              184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1448
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5908
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDAD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4112
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:812
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE69.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                          188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4156
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1316
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF15.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                  190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1852
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5020
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFA1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                      192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4284
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4544
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a102E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                            194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1632
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5988
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a10AB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1137.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a11B4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1241.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a12DD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a135A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a13D7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1474.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a14F1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2104
                                                                                                                                                • C:\Windows\Logo1_.exe
                                                                                                                                                  C:\Windows\Logo1_.exe
                                                                                                                                                  38⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                  PID:3180
                                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                                    net stop "Kingsoft AntiVirus Service"
                                                                                                                                                    39⤵
                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                    PID:904
                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                      40⤵
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:3948
                                                                        • C:\Windows\Logo1_.exe
                                                                          C:\Windows\Logo1_.exe
                                                                          2⤵
                                                                          • Executes dropped EXE
                                                                          • Enumerates connected drives
                                                                          • Drops file in Program Files directory
                                                                          • Drops file in Windows directory
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:4624
                                                                          • C:\Windows\SysWOW64\net.exe
                                                                            net stop "Kingsoft AntiVirus Service"
                                                                            3⤵
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:1456
                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                              4⤵
                                                                                PID:1584
                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 980
                                                                              3⤵
                                                                              • Program crash
                                                                              PID:1240
                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4624 -ip 4624
                                                                          1⤵
                                                                            PID:1764

                                                                          Network

                                                                                MITRE ATT&CK Enterprise v16

                                                                                Replay Monitor

                                                                                Loading Replay Monitor...

                                                                                Downloads

                                                                                $$aA426.bat
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aA426.bat
                                                                                • Size 722B
                                                                                • SHA256 3ad4ccb852626dad5c1ea893884a0e83ce547d5a4f02508672012309b118554b
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                $$aA7DF.bat
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aA7DF.bat
                                                                                • Size 722B
                                                                                • SHA256 b18835b2783ec494e08c2ca981047c7d4d0729095f5254999f10422dd052be8e
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                $$aA9F2.bat
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aA9F2.bat
                                                                                • Size 722B
                                                                                • SHA256 ed7bdbaa9343b0f0f1375f903e939dd4e91013f70ee2af8afa436c503a8ed854
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                $$aAC15.bat
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aAC15.bat
                                                                                • Size 722B
                                                                                • SHA256 a5d3fbadf3f40f5dcfffb3689de22e96a34f9c18c6346ee8621fc2792cc91e17
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                $$aAE18.bat
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aAE18.bat
                                                                                • Size 722B
                                                                                • SHA256 0452faf0b203af16952adb066385dad9a4957f19d0efd2ca7d5cf662665c434f
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                $$aAFFD.bat
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aAFFD.bat
                                                                                • Size 722B
                                                                                • SHA256 76e3b74fd2037a49f85712402bc92ab24e4f3726a5f77b60fe31df755d69fc8f
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                $$aB200.bat
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aB200.bat
                                                                                • Size 722B
                                                                                • SHA256 769b130ff259a118814469ea72a862f98e138ea512d25c9922359a082d4a2f5f
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                $$aB404.bat
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aB404.bat
                                                                                • Size 722B
                                                                                • SHA256 89f308ab0bc38689ccc1b8910d2bfa8d0eb85f4fc3a07b68fdc93bc0abf680ca
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                $$aB608.bat
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aB608.bat
                                                                                • Size 722B
                                                                                • SHA256 32207906d9e9c9f253232efc82a0bc58f4d55851341af438d9c429ad9d345923
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                $$aB80B.bat
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aB80B.bat
                                                                                • Size 722B
                                                                                • SHA256 a87fd612d62f98985bead47eecbafc6fef4f97faf96ef233353af4dc6603447f
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                $$aBB19.bat
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aBB19.bat
                                                                                • Size 722B
                                                                                • SHA256 8e4298b82708401f448dedf6697150e166795bec6594c13196c6484510290562
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                $$aC24C.bat
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aC24C.bat
                                                                                • Size 722B
                                                                                • SHA256 00615caeec8f44e5ed03774a15e5644c210ffd060319e2c6f973f1d5bfb9eb42
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                $$aC3B4.bat
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aC3B4.bat
                                                                                • Size 722B
                                                                                • SHA256 c6d459d9d54e08f34e41177a5f4d144919850d69ab4cd385b30a714f56dbaabb
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                $$aCA6A.bat
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aCA6A.bat
                                                                                • Size 722B
                                                                                • SHA256 cee62a73718ed8b372e3dc07193e4a1ed5d5f2c542315cb210cf8dcee0031760
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                $$aCF9B.bat
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aCF9B.bat
                                                                                • Size 722B
                                                                                • SHA256 6f04d0d2015cb2fed7267cd050d1033e5dbe74abc99b52feaf8770d7dbb258ac
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                $$aD3F0.bat
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aD3F0.bat
                                                                                • Size 722B
                                                                                • SHA256 9499551068d16ed5bdb161d19bee9d2877a408a6de6c3f9653af29c12bc79239
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                $$aD586.bat
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aD586.bat
                                                                                • Size 722B
                                                                                • SHA256 3987ccc4ecfcdc380bf01738a2010f4a0838adf9c85013134e9b437edb7b6f9c
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                $$aD8E2.bat
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aD8E2.bat
                                                                                • Size 722B
                                                                                • SHA256 0c7ebbaab3362893fbe313f5a91ebd085f50a5e42a81de2f2203753a2c8c02f8
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                $$aDA87.bat
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aDA87.bat
                                                                                • Size 722B
                                                                                • SHA256 70717c299c3e080e5aafe6e4db611f90439cfe78cc05f6a5908a3ad9d6b53d6f
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe.exe
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe.exe
                                                                                • Size 3.3MB
                                                                                • SHA256 89049fcadd5686111b3bd23da1b3c2482ea24af64e14896084e064a32f9fabda
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe.exe
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe.exe
                                                                                • Size 3.2MB
                                                                                • SHA256 f7f6e883eb4689e9a266bec922e7bdefd10ca8c96e8cf36c7346f06268e5b203
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe.exe
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe.exe
                                                                                • Size 3.3MB
                                                                                • SHA256 02c99228c9a88a34c5bcecb76885b8c88df64ef38fdadfbb490861549b5870cf
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe.exe
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe.exe
                                                                                • Size 3.3MB
                                                                                • SHA256 80e3945de4687171a3b76f6bcf5d1034fdf8129e826035653e034d65617c6e8a
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe.exe
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe.exe
                                                                                • Size 3.2MB
                                                                                • SHA256 a2c1cb5ea0b11c7b86ea04d0752e09f29fe73ed4772cd424a7e7ade5de0c57dd
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe.exe
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe.exe
                                                                                • Size 3.3MB
                                                                                • SHA256 16d5dcc61056857cd361aea1191d279135d7b918782448d2cd8d306114201e78
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe.exe
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe.exe
                                                                                • Size 3.4MB
                                                                                • SHA256 5fb2dee3c9951e58611e4d4bc37307846dc9e43e1adcc6f3ce892df98ef220bf
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe.exe
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe.exe
                                                                                • Size 3.4MB
                                                                                • SHA256 7e2425b1c79534060dab4a59f7cb6029c9096408ae42821c25b69b2046f8238a
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe.exe
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe.exe
                                                                                • Size 3.4MB
                                                                                • SHA256 49739ea1c1b5f6e6a677491b408bf1d42ce0cb83362a2a4151ab3ca48e688244
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe.exe
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe.exe
                                                                                • Size 3.7MB
                                                                                • SHA256 057db27324fd2b19b0180a6815e927cfaeb21feb2876092c5b808759505fdd6a
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe.exe
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe.exe
                                                                                • Size 3.7MB
                                                                                • SHA256 d10c6469f644449550e5faea798d95b22e6d65b00f3ff46ebcc4d5a3713759d6
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe.exe
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe.exe
                                                                                • Size 3.8MB
                                                                                • SHA256 40aadef1cda6adc428a53a4b74620088cec3192ff458c76f47b43ef4b5e8b811
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe.exe
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe.exe
                                                                                • Size 3.6MB
                                                                                • SHA256 e56d6329e8c0fecc3b8ac21a70c37788c8e931b80f1105ff8a2b8efa5cfa816e
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe.exe
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe.exe
                                                                                • Size 3.7MB
                                                                                • SHA256 93168c408dbecae87466dc0a7713bcf46fc3b711d0fc8d15d19cbee884c198e1
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe.exe
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe.exe
                                                                                • Size 3.5MB
                                                                                • SHA256 28a3b2536d0b8dfa5bf4a3d308f7b252c62ded35f92f6ce0b9df12dd7db65e46
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe.exe
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe.exe
                                                                                • Size 3.6MB
                                                                                • SHA256 c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe.exe
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe.exe
                                                                                • Size 3.5MB
                                                                                • SHA256 b1c65b407ae33c08f108e1bd0d698d20dc54a13ae1f48731c0fc8de094fe2e18
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe.exe
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe.exe
                                                                                • Size 3.6MB
                                                                                • SHA256 ba7ecca71c6ea0eba7624394d57d0045ae3477acc9025e7ca5d58f9784f793bc
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe.exe
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82.exe.exe
                                                                                • Size 3.5MB
                                                                                • SHA256 9df9076c1b0c00b16bc342a9f53f96e68f8665adaa0c191b8b7e8631328924d0
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                Logo1_.exe
                                                                                • Path C:\Windows\Logo1_.exe
                                                                                • Size 32KB
                                                                                • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                _desktop.ini
                                                                                • Path F:\$RECYCLE.BIN\S-1-5-21-1404337215-1550464601-2805570857-1000\_desktop.ini
                                                                                • Size 9B
                                                                                • SHA256 346de4d5debec31c9a445d77ea11610cbefd2c8caf903962fbf17b7ec8847d33
                                                                                • MD5 SHA1 SHA512
                                                                                Submit Download

                                                                                memory/200-4987-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/472-5046-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/572-4847-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/792-4982-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/812-5185-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/856-22-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/980-4937-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/1052-4992-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/1300-4842-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/1316-5191-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/1372-4957-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/1392-5022-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/1468-4795-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/1628-5028-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/1752-4785-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/1792-5071-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/1948-5167-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/1956-4872-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/1996-4739-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/2024-4837-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/2032-1880-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/2392-4892-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/2396-5040-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/2544-4897-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/2588-5089-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/2776-4882-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/2832-1872-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/2864-4867-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/2936-4932-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/2964-5010-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/2980-4962-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/3000-4747-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/3012-4811-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/3080-4790-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/3096-4827-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/3120-5077-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/3124-5252-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/3124-5258-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/3172-101-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/3180-4822-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/3236-4357-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/3240-4912-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/3268-5107-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/3292-83-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/3316-5251-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/3336-5119-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/3388-4887-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/3496-5245-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/3520-5004-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/3552-5125-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/3624-5034-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/3848-4877-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/3852-5233-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/3916-5149-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/4056-5227-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/4188-32-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/4192-4832-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/4220-4800-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/4368-3164-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/4384-5155-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/4408-5173-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/4432-4816-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/4452-5113-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/4544-5203-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/4568-5095-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/4572-5161-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/4624-209-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/4624-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/4624-4757-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/4624-4008-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/4628-55-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/4656-4780-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/4680-5137-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/4688-75-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/4748-4977-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/4904-5131-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/4976-321-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/5000-5052-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/5020-5197-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/5028-4862-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/5072-4907-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/5076-93-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/5100-4942-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/5140-5143-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/5160-5239-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/5228-5215-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/5280-4902-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/5320-5101-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/5352-4772-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/5356-4821-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/5368-4952-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/5440-4922-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/5484-4947-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/5492-4927-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/5508-41-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/5528-4972-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/5576-4857-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/5688-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/5688-12-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/5696-5083-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/5728-4998-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/5748-4755-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/5780-5065-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/5812-5221-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/5908-5179-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/5928-4917-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/5960-5058-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/5988-5209-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/6016-4967-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/6028-5016-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/6036-4852-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/6100-63-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download

                                                                                memory/6116-4806-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                Download