Overview

overview

7

Static

static

3

8fc8f35343...7f.exe

windows10-2004-x64

7

8fc8f35343...7f.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    126s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    25/09/2026, 08:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
  • Size 4.7MB
  • Sample260925-j3vlcssz8r
  • SHA256 8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
    "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5392
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a78FF.bat
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3248
      • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
        "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:4552
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7B70.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2668
          • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
            "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:3960
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9466.bat
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:200
              • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:6060
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA781.bat
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:2220
                  • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                    "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                    9⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:4388
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBFFB.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2848
                      • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                        "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:3756
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCCDB.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2960
                          • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                            "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:3596
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDCE9.bat
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:2968
                              • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:5896
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE739.bat
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:5144
                                  • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                    "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:1352
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEECB.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:4920
                                      • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                        "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • Suspicious use of WriteProcessMemory
                                        PID:5800
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF68B.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • Suspicious use of WriteProcessMemory
                                          PID:5576
                                          • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                            "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • Suspicious use of WriteProcessMemory
                                            PID:2768
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4D4.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • Suspicious use of WriteProcessMemory
                                              PID:5940
                                              • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of WriteProcessMemory
                                                PID:5348
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1176.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:6028
                                                  • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:5320
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1C05.bat
                                                      26⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:5316
                                                      • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:1588
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a256B.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:5440
                                                          • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:3040
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a30B6.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:4820
                                                              • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:4260
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3896.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:5996
                                                                  • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:2244
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3F5C.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:1308
                                                                      • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:4408
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4586.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:2756
                                                                          • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:3760
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4BB0.bat
                                                                              38⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:5620
                                                                              • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:584
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a517D.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:1784
                                                                                  • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:4612
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a567E.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:452
                                                                                      • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:4600
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5B6F.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:4940
                                                                                          • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:1576
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5C5A.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:3388
                                                                                              • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:4176
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5D35.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:5988
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:1500
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5E1F.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:1488
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:3324
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5F19.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:5804
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:3244
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5FF4.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:4816
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:2584
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a60EE.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:4368
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:5208
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a61E8.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:4316
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:3224
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a62B3.bat
                                                                                                                          60⤵
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:6136
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:5036
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a638E.bat
                                                                                                                              62⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:2860
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Drops file in Windows directory
                                                                                                                                PID:2428
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6468.bat
                                                                                                                                  64⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:1452
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                    65⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Drops file in Windows directory
                                                                                                                                    PID:4180
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6553.bat
                                                                                                                                      66⤵
                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                      PID:5420
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                        67⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:5600
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6A54.bat
                                                                                                                                          68⤵
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:2976
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                            69⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:1728
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6B2F.bat
                                                                                                                                              70⤵
                                                                                                                                                PID:4224
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                  71⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:612
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6C58.bat
                                                                                                                                                    72⤵
                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:3024
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                      73⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:4672
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6D71.bat
                                                                                                                                                        74⤵
                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:5916
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                          75⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:5176
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6E5B.bat
                                                                                                                                                            76⤵
                                                                                                                                                              PID:2424
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                77⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:3728
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6F65.bat
                                                                                                                                                                  78⤵
                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                  PID:4592
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                    79⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    PID:1568
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7030.bat
                                                                                                                                                                      80⤵
                                                                                                                                                                        PID:3748
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                          81⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                          PID:1252
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a711A.bat
                                                                                                                                                                            82⤵
                                                                                                                                                                              PID:4648
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                83⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                PID:4460
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7205.bat
                                                                                                                                                                                  84⤵
                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                  PID:400
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                    85⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    PID:4360
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a72EF.bat
                                                                                                                                                                                      86⤵
                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                      PID:6012
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                        87⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:3160
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a73BA.bat
                                                                                                                                                                                          88⤵
                                                                                                                                                                                            PID:2300
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                              89⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                              PID:1760
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a74B4.bat
                                                                                                                                                                                                90⤵
                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                PID:2704
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                  91⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                  PID:2812
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a75AE.bat
                                                                                                                                                                                                    92⤵
                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                    PID:4564
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                      93⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      PID:4256
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7679.bat
                                                                                                                                                                                                        94⤵
                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                        PID:2016
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                          95⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                          PID:1552
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7764.bat
                                                                                                                                                                                                            96⤵
                                                                                                                                                                                                              PID:2824
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                97⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                PID:5732
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a783E.bat
                                                                                                                                                                                                                  98⤵
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  PID:4444
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                    99⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                    PID:5092
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a78FA.bat
                                                                                                                                                                                                                      100⤵
                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                      PID:3424
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                        101⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        PID:4852
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a79D5.bat
                                                                                                                                                                                                                          102⤵
                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                          PID:1676
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                            103⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                            PID:2256
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7AA0.bat
                                                                                                                                                                                                                              104⤵
                                                                                                                                                                                                                                PID:2452
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                  105⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                  PID:5516
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7B8A.bat
                                                                                                                                                                                                                                    106⤵
                                                                                                                                                                                                                                      PID:3548
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                        107⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                        PID:2624
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7C75.bat
                                                                                                                                                                                                                                          108⤵
                                                                                                                                                                                                                                            PID:1512
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                              109⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              PID:5656
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7D5F.bat
                                                                                                                                                                                                                                                110⤵
                                                                                                                                                                                                                                                  PID:1116
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                    111⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    PID:1872
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E69.bat
                                                                                                                                                                                                                                                      112⤵
                                                                                                                                                                                                                                                        PID:4544
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                          113⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                          PID:2572
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7F43.bat
                                                                                                                                                                                                                                                            114⤵
                                                                                                                                                                                                                                                              PID:4932
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                115⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                PID:4156
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a801E.bat
                                                                                                                                                                                                                                                                  116⤵
                                                                                                                                                                                                                                                                    PID:2528
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                      117⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      PID:3716
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a80E9.bat
                                                                                                                                                                                                                                                                        118⤵
                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                        PID:4464
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                          119⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                          PID:4860
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a81B4.bat
                                                                                                                                                                                                                                                                            120⤵
                                                                                                                                                                                                                                                                              PID:4632
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                121⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                PID:5140
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a828F.bat
                                                                                                                                                                                                                                                                                  122⤵
                                                                                                                                                                                                                                                                                    PID:900
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                      123⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                      PID:1456
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a836A.bat
                                                                                                                                                                                                                                                                                        124⤵
                                                                                                                                                                                                                                                                                          PID:4120
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                            125⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            PID:2836
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8425.bat
                                                                                                                                                                                                                                                                                              126⤵
                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                              PID:3840
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                127⤵
                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                PID:1140
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8510.bat
                                                                                                                                                                                                                                                                                                  128⤵
                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                  PID:712
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                    129⤵
                                                                                                                                                                                                                                                                                                      PID:868
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a85BC.bat
                                                                                                                                                                                                                                                                                                        130⤵
                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                        PID:4284
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                          131⤵
                                                                                                                                                                                                                                                                                                            PID:1804
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8687.bat
                                                                                                                                                                                                                                                                                                              132⤵
                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                              PID:4244
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                133⤵
                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                PID:2728
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8781.bat
                                                                                                                                                                                                                                                                                                                  134⤵
                                                                                                                                                                                                                                                                                                                    PID:2656
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                      135⤵
                                                                                                                                                                                                                                                                                                                        PID:2228
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a882D.bat
                                                                                                                                                                                                                                                                                                                          136⤵
                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                          PID:6092
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                            137⤵
                                                                                                                                                                                                                                                                                                                              PID:3496
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a88E8.bat
                                                                                                                                                                                                                                                                                                                                138⤵
                                                                                                                                                                                                                                                                                                                                  PID:4084
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                    139⤵
                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                    PID:4172
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8984.bat
                                                                                                                                                                                                                                                                                                                                      140⤵
                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                      PID:3508
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                        141⤵
                                                                                                                                                                                                                                                                                                                                          PID:4364
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A30.bat
                                                                                                                                                                                                                                                                                                                                            142⤵
                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                            PID:3992
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                              143⤵
                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                              PID:2164
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B0B.bat
                                                                                                                                                                                                                                                                                                                                                144⤵
                                                                                                                                                                                                                                                                                                                                                  PID:4956
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                    145⤵
                                                                                                                                                                                                                                                                                                                                                      PID:2068
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8BA7.bat
                                                                                                                                                                                                                                                                                                                                                        146⤵
                                                                                                                                                                                                                                                                                                                                                          PID:4312
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                            147⤵
                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                            PID:5512
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C92.bat
                                                                                                                                                                                                                                                                                                                                                              148⤵
                                                                                                                                                                                                                                                                                                                                                                PID:2396
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                  149⤵
                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                  PID:2296
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D4D.bat
                                                                                                                                                                                                                                                                                                                                                                    150⤵
                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                    PID:5248
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                      151⤵
                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                      PID:4964
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E18.bat
                                                                                                                                                                                                                                                                                                                                                                        152⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:5152
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                            153⤵
                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                            PID:5772
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8ED4.bat
                                                                                                                                                                                                                                                                                                                                                                              154⤵
                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                              PID:5700
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                155⤵
                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                PID:4160
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F8F.bat
                                                                                                                                                                                                                                                                                                                                                                                  156⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  PID:4236
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                    157⤵
                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                    PID:1656
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a907A.bat
                                                                                                                                                                                                                                                                                                                                                                                      158⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                      PID:760
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                        159⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                        PID:5856
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9164.bat
                                                                                                                                                                                                                                                                                                                                                                                          160⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                          PID:3420
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                            161⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:1612
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a922F.bat
                                                                                                                                                                                                                                                                                                                                                                                                162⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                PID:2912
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  163⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                  PID:4252
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a92CB.bat
                                                                                                                                                                                                                                                                                                                                                                                                    164⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:2488
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        165⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                        PID:3504
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9377.bat
                                                                                                                                                                                                                                                                                                                                                                                                          166⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4412
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              167⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5624
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9433.bat
                                                                                                                                                                                                                                                                                                                                                                                                                168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2932
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2828
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a94CF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                    170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5752
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5832
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a958A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                          172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2644
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6100
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9656.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1616
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4228
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a96F2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                      176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1240
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2240
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a97BD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                              178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3276
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3980
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9859.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                      180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1660
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3684
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9905.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                          182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1040
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5744
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a99C1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                              184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A9B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B57.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C22.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9CDD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D89.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E64.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F20.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9FCB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA097.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA142.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA20E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA2E8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA3A4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA440.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA4CD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA569.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA634.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA6C1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA77C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA867.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA932.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA9DE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA99.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB45.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC00.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC9D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD49.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aADD5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE81.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF2D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAFE8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB0A4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB150.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB1DC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB279.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB325.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB3B1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB42E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB4BB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB547.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB5E4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB680.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB71C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4220
                                                                                                                                              • C:\Windows\Logo1_.exe
                                                                                                                                                C:\Windows\Logo1_.exe
                                                                                                                                                2⤵
                                                                                                                                                • Creates a file in the Startup directory
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Enumerates connected drives
                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                PID:4664
                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                  net stop "Kingsoft AntiVirus Service"
                                                                                                                                                  3⤵
                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                  PID:2844
                                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                    4⤵
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:1312

                                                                                                                                            Network

                                                                                                                                                  MITRE ATT&CK Enterprise v16

                                                                                                                                                  Replay Monitor

                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                  Downloads

                                                                                                                                                  $$a1176.bat
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a1176.bat
                                                                                                                                                  • Size 722B
                                                                                                                                                  • SHA256 678e29b675f31ec265a1247bacdaece597b058dc78a49b5f59f3e3203f5e18b5
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  $$a1C05.bat
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a1C05.bat
                                                                                                                                                  • Size 722B
                                                                                                                                                  • SHA256 36cfeafd79f71548078e12bbe0639976196aeedac28cd2b1a5caded59a444239
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  $$a256B.bat
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a256B.bat
                                                                                                                                                  • Size 722B
                                                                                                                                                  • SHA256 e9a752a3371772b1584b149494afefafdce7c86fe85a976bcf9a3b7c8ff0e0b2
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  $$a30B6.bat
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a30B6.bat
                                                                                                                                                  • Size 722B
                                                                                                                                                  • SHA256 b5db5241994b85bd0c8d040b51ff02c1b0a2fae9280028b8497f961190f8f793
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  $$a3896.bat
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a3896.bat
                                                                                                                                                  • Size 722B
                                                                                                                                                  • SHA256 34a4337825990858982e9f474dfafc6e820bd6425763c3446fd82e8d331e07e2
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  $$a3F5C.bat
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a3F5C.bat
                                                                                                                                                  • Size 722B
                                                                                                                                                  • SHA256 56d0d8d0583289f94e910d484ab8da5e74e2c515e17daf907b8792e3928be63f
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  $$a4586.bat
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a4586.bat
                                                                                                                                                  • Size 722B
                                                                                                                                                  • SHA256 36199886c6b3545f22f829191db64def4cfa12efa8a1cac9ca1d33420014c376
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  $$a4BB0.bat
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a4BB0.bat
                                                                                                                                                  • Size 722B
                                                                                                                                                  • SHA256 8d126bcefc1b31d7d07792c3daa30dfda2c47cf52ae43c4bcf12ab5d87c625d3
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  $$a4D4.bat
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a4D4.bat
                                                                                                                                                  • Size 721B
                                                                                                                                                  • SHA256 49e94ed9094f47b508766008d33747492be8a43678f79068b671290e7790489d
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  $$a517D.bat
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a517D.bat
                                                                                                                                                  • Size 722B
                                                                                                                                                  • SHA256 7ea387cb04cf9cb55472513da9d07260c737d0052f445ae4899d2db14458a780
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  $$a567E.bat
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a567E.bat
                                                                                                                                                  • Size 722B
                                                                                                                                                  • SHA256 af891cf9142f8d1c7a3cb5101f9057513bec0fc089aed124cd9413192c6233bd
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  $$a78FF.bat
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a78FF.bat
                                                                                                                                                  • Size 722B
                                                                                                                                                  • SHA256 91e10bdc642b19c56866a0a64c6c218d0a3e7751c509ddedd20153de6cc890cc
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  $$a7B70.bat
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a7B70.bat
                                                                                                                                                  • Size 722B
                                                                                                                                                  • SHA256 e71b7550fe8318d6f9419e6cf7948e2a42adb183b130d324df53d86149851fc5
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  $$a9466.bat
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a9466.bat
                                                                                                                                                  • Size 722B
                                                                                                                                                  • SHA256 6facd45061929bab381120cfd8369403d83a0e43e3c5aa470b60af57aae037a1
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  $$aA781.bat
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aA781.bat
                                                                                                                                                  • Size 722B
                                                                                                                                                  • SHA256 226d7707f4cd316fb4b1c230f6f6388bd62e155b275c2a51953edf44ffef991e
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  $$aBFFB.bat
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aBFFB.bat
                                                                                                                                                  • Size 722B
                                                                                                                                                  • SHA256 470d7a8255932feda49f7fc10728c68e5f4d41068c8dc0324229d281df9b586a
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  $$aCCDB.bat
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aCCDB.bat
                                                                                                                                                  • Size 722B
                                                                                                                                                  • SHA256 e4183bf5c685f8d0594c30b04eb57b0355bbcb444d9e170f63b1f91e6c1c11fc
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  $$aDCE9.bat
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aDCE9.bat
                                                                                                                                                  • Size 722B
                                                                                                                                                  • SHA256 9840966129010c87407292c1f032ba8745dbf4a3f9d5308cd45f0268ff8e96b5
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  $$aE739.bat
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aE739.bat
                                                                                                                                                  • Size 722B
                                                                                                                                                  • SHA256 65fd8b10f496573fc4550641ed85c0c06cfe4a7f16cac4a4a659ea19c01be983
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  $$aEECB.bat
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aEECB.bat
                                                                                                                                                  • Size 722B
                                                                                                                                                  • SHA256 9c96a166a22220e8da363515e982d21de6d08d14726baf1f583a03491822b551
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  $$aF68B.bat
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aF68B.bat
                                                                                                                                                  • Size 722B
                                                                                                                                                  • SHA256 90ba14e32a8804eea476ef85e43c513445268c970d380aea83459dccb99e04c9
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe.exe
                                                                                                                                                  • Size 4.6MB
                                                                                                                                                  • SHA256 47cdba12a44a0b2bdd51b705e8115e273495a08504040c9709af395fc8595281
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe.exe
                                                                                                                                                  • Size 4.6MB
                                                                                                                                                  • SHA256 82233ed2350ff7742fc096af62ea369142e5f46090c6994b92229d497912c0ea
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe.exe
                                                                                                                                                  • Size 4.5MB
                                                                                                                                                  • SHA256 a13f6eff2be4433aab03c2b4f3f382acccf2680e61eb3d7f502cac6e48b2887d
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe.exe
                                                                                                                                                  • Size 4.5MB
                                                                                                                                                  • SHA256 4b32c921170236961b7af919ff727929edc455846b93c3b24c344624f0b72da8
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe.exe
                                                                                                                                                  • Size 4.5MB
                                                                                                                                                  • SHA256 df1c31f4e75a17de040fbd3b3510c5914410bb98fc203a33d0561dc14f479e5a
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe.exe
                                                                                                                                                  • Size 4.4MB
                                                                                                                                                  • SHA256 74d1a1666bffeea93f0c85cf5518c30bf83eec80ec78fa43ae58f66f126858de
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe.exe
                                                                                                                                                  • Size 4.4MB
                                                                                                                                                  • SHA256 0e1171f33fb95758e0139633dba31a9d5de6e2e1e81953a9751780435dfbfff0
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe.exe
                                                                                                                                                  • Size 4.4MB
                                                                                                                                                  • SHA256 15a31bdf0680a6aad03d9d65acff5c4064d767c7ea4968d08f436e88952659af
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe.exe
                                                                                                                                                  • Size 4.6MB
                                                                                                                                                  • SHA256 70a4efbda6914d5b0efb171f1410f21186a8ff6f1b36ccb35d775fb5105f6401
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe.exe
                                                                                                                                                  • Size 4.3MB
                                                                                                                                                  • SHA256 0fdc97251d7171798d7127fe3c8dd56f4186d28e31d82235cadf5c9e4024c50e
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe.exe
                                                                                                                                                  • Size 4.3MB
                                                                                                                                                  • SHA256 c4c5a3c46e9e56c0c3999937f53d8bb9c7a9e4b408ccd8ae177f72f02bf6dcd3
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe.exe
                                                                                                                                                  • Size 4.3MB
                                                                                                                                                  • SHA256 3aba9f0fcf3f37a87ac169b1b56223cf5cbc57a39e8531860b089d495b4036af
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe.exe
                                                                                                                                                  • Size 4.2MB
                                                                                                                                                  • SHA256 eb5333835492d7b541ae3fe55828ff5a72ab20e40fe516189357d423d89867a6
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe.exe
                                                                                                                                                  • Size 4.2MB
                                                                                                                                                  • SHA256 475ef75f630bca5cd6dcbd7414910e6184ed323b6721cdd4d97dd2b30f2a699d
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe.exe
                                                                                                                                                  • Size 4.2MB
                                                                                                                                                  • SHA256 6dafd7f4e52e3337868dae94e3d3c7ebba1744756ad1eed410e130560d04a5c6
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe.exe
                                                                                                                                                  • Size 4.7MB
                                                                                                                                                  • SHA256 66efaa53b4778ffa2fa3a0429c713e14f2e534592bba26f0b90dca0460ef7127
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe.exe
                                                                                                                                                  • Size 4.7MB
                                                                                                                                                  • SHA256 2ce7f799e5c483ad3bd7b35970416ca9b4af5f58eaa73f43a1b4e47d2e5640a1
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe.exe
                                                                                                                                                  • Size 4.2MB
                                                                                                                                                  • SHA256 4d9f4ec76b735f0590414e694c518db45e3569d1648dd9326660edcca7501037
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe.exe
                                                                                                                                                  • Size 4.1MB
                                                                                                                                                  • SHA256 48a7e423afd54cc69c555f6283d6cc6f2334cf237396eee7fd883e22fce4b102
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\8fc8f353436dcf9013a3293005698193fc80efa63b94c3bc01cde3d97eeee47f.exe.exe
                                                                                                                                                  • Size 4.1MB
                                                                                                                                                  • SHA256 d7a578f523d1851fb7ccfc2c972ec480771a12ef061b2edf496bf91da35ccc9d
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Logo1_.exe
                                                                                                                                                  • Path C:\Windows\Logo1_.exe
                                                                                                                                                  • Size 32KB
                                                                                                                                                  • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  _desktop.ini
                                                                                                                                                  • Path F:\$RECYCLE.BIN\S-1-5-21-461973139-3212354679-1508698038-1000\_desktop.ini
                                                                                                                                                  • Size 9B
                                                                                                                                                  • SHA256 1020704fe83c7e64802b1428d9e5641e37d7c7eef9077c5ed54d2d7974c3c891
                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                  Submit Download

                                                                                                                                                  memory/296-8558-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/540-8642-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/560-8576-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/584-8109-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/612-8194-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/808-8582-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/868-8341-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/916-8630-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/924-8745-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1088-8727-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1140-8335-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1252-8219-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1352-8019-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1456-8324-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1500-8138-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1552-8254-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1568-8214-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1576-8128-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1588-8060-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1612-8438-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1656-8426-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1680-8709-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1724-8678-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1728-8189-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1760-8239-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1804-8347-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1872-8294-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1924-8721-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2068-8390-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2164-8384-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2176-8528-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2200-8618-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2228-8359-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2240-8486-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2244-8085-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2256-8274-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2296-8402-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2372-8570-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2428-8174-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2552-8522-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2572-8299-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2584-8153-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2624-8284-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2672-8564-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2716-8534-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2728-8353-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2768-8035-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2784-8684-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2812-8244-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2828-8462-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2836-8329-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2888-8588-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2980-8757-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2988-8672-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3012-8715-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3040-8068-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3044-8600-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3128-8660-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3160-8234-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3172-8624-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3224-8163-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3244-8148-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3324-8143-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3416-8696-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3452-8666-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3496-8365-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3504-8450-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3540-8654-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3596-8002-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3684-8498-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3716-8309-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3728-8209-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3756-7994-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3760-8101-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3960-1534-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3980-8492-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4132-8546-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4156-8304-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4160-8420-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4172-8371-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4176-8133-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4180-8179-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4208-8702-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4228-8480-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4252-8444-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4256-8249-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4260-8076-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4360-8229-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4364-8377-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4388-7983-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4408-8093-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4460-8224-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4496-8510-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4516-8516-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4520-8690-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4552-23-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4600-8123-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4612-8117-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4664-2480-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4664-3181-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4664-7987-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4664-12-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4672-8199-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4852-8269-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4860-8314-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4964-8408-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5028-8739-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5036-8168-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5068-8540-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5092-8264-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5140-8319-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5148-8751-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5176-8204-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5208-8158-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5292-8612-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5320-8052-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5348-8043-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5392-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5392-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5512-8396-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5516-8279-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5600-8184-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5624-8456-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5648-8552-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5656-8289-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5732-8259-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5744-8504-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5772-8414-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5800-8027-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5824-8606-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5832-8468-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5852-8594-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5856-8432-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5880-8764-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5880-8758-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5896-8010-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5948-8733-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5972-8636-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5976-8648-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6060-4943-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6100-8474-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download