Overview

overview

7

Static

static

3

426d03a59e...46.exe

windows10-2004-x64

7

426d03a59e...46.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    30/09/2026, 08:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe
  • Size 2.1MB
  • Sample260930-j5pg5axy2n
  • SHA256 426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 54 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 56 IoCs
  • Executes a command shell one-liner 1 TTPs 53 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe
    "C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3020
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a843E.bat
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3376
      • C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe
        "C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1268
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8671.bat
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4400
          • C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe
            "C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:2304
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a87A9.bat
              6⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2016
              • C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe
                "C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:684
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A59.bat
                  8⤵
                  • Executes a command shell one-liner
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:3340
                  • C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe
                    "C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of WriteProcessMemory
                    PID:1416
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C4D.bat
                      10⤵
                      • Executes a command shell one-liner
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:3772
                      • C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe
                        "C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:3300
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E02.bat
                          12⤵
                          • Executes a command shell one-liner
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:3892
                          • C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe
                            "C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of WriteProcessMemory
                            PID:4908
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8FE7.bat
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:956
                              • C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe
                                "C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious use of WriteProcessMemory
                                PID:3416
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a919C.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:540
                                  • C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe
                                    "C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:1200
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9239.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:3544
                                      • C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe
                                        "C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:4024
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a93B0.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • Suspicious use of WriteProcessMemory
                                          PID:4136
                                          • C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe
                                            "C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • Suspicious use of WriteProcessMemory
                                            PID:2380
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9611.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • Suspicious use of WriteProcessMemory
                                              PID:4280
                                              • C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe
                                                "C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious use of WriteProcessMemory
                                                PID:4220
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9778.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:4228
                                                  • C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:2896
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a98E0.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:564
                                                      • C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:5076
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9CC8.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:2540
                                                          • C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:1192
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA004.bat
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:1848
                                                              • C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:2032
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA0DF.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:4996
                                                                  • C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:3220
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA227.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:2116
                                                                      • C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:2296
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA3EC.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:4524
                                                                          • C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:3180
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA5A1.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:3060
                                                                              • C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:4600
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA812.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:4408
                                                                                  • C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:2120
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA8BE.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:3296
                                                                                      • C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:1792
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA16.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:1880
                                                                                          • C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:4392
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB2F.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:3024
                                                                                              • C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:3992
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC1A.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:3716
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:1292
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD33.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:3592
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:2984
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAFC3.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:2924
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:3796
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB08E.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:2188
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:1320
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB198.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:4160
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:1148
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB418.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:4348
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:4552
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB512.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:4800
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:3424
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB5DE.bat
                                                                                                                              62⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:1248
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Drops file in Windows directory
                                                                                                                                PID:2920
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB726.bat
                                                                                                                                  64⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:4044
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe"
                                                                                                                                    65⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Drops file in Windows directory
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:3432
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB83F.bat
                                                                                                                                      66⤵
                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:1508
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe"
                                                                                                                                        67⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Drops file in Windows directory
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:4544
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB939.bat
                                                                                                                                          68⤵
                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:368
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe"
                                                                                                                                            69⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            PID:4248
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA33.bat
                                                                                                                                              70⤵
                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:4500
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe"
                                                                                                                                                71⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:932
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB0E.bat
                                                                                                                                                  72⤵
                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:1860
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe"
                                                                                                                                                    73⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                    PID:2584
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC56.bat
                                                                                                                                                      74⤵
                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:1092
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe"
                                                                                                                                                        75⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:2628
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD50.bat
                                                                                                                                                          76⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:4884
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe"
                                                                                                                                                            77⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                            PID:4904
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBDDC.bat
                                                                                                                                                              78⤵
                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:4440
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe"
                                                                                                                                                                79⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                PID:2704
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE69.bat
                                                                                                                                                                  80⤵
                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                  PID:2012
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe"
                                                                                                                                                                    81⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:3708
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBFC1.bat
                                                                                                                                                                      82⤵
                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      PID:4224
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe"
                                                                                                                                                                        83⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                        PID:4308
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC0BB.bat
                                                                                                                                                                          84⤵
                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          PID:4888
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe"
                                                                                                                                                                            85⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                            PID:4432
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC35B.bat
                                                                                                                                                                              86⤵
                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:4840
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe"
                                                                                                                                                                                87⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                PID:1440
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC455.bat
                                                                                                                                                                                  88⤵
                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  PID:3384
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe"
                                                                                                                                                                                    89⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                    PID:4032
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC520.bat
                                                                                                                                                                                      90⤵
                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:1232
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe"
                                                                                                                                                                                        91⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                        PID:4836
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC5BC.bat
                                                                                                                                                                                          92⤵
                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:1636
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe"
                                                                                                                                                                                            93⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            PID:4780
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC668.bat
                                                                                                                                                                                              94⤵
                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                              PID:1872
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe"
                                                                                                                                                                                                95⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                PID:5072
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC733.bat
                                                                                                                                                                                                  96⤵
                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                  PID:3044
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe"
                                                                                                                                                                                                    97⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:5088
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC7B0.bat
                                                                                                                                                                                                      98⤵
                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                      PID:2172
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe"
                                                                                                                                                                                                        99⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                        PID:220
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC83D.bat
                                                                                                                                                                                                          100⤵
                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                          PID:4428
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe"
                                                                                                                                                                                                            101⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                            PID:3140
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC8D9.bat
                                                                                                                                                                                                              102⤵
                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:1132
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe"
                                                                                                                                                                                                                103⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                PID:3804
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC985.bat
                                                                                                                                                                                                                  104⤵
                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  PID:3648
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe"
                                                                                                                                                                                                                    105⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                    PID:700
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA11.bat
                                                                                                                                                                                                                      106⤵
                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                      PID:384
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe"
                                                                                                                                                                                                                        107⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                        PID:3800
    • C:\Windows\Logo1_.exe
      C:\Windows\Logo1_.exe
      2⤵
      • Creates a file in the Startup directory
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2800
      • C:\Windows\SysWOW64\net.exe
        net stop "Kingsoft AntiVirus Service"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:820
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
          4⤵
            PID:3064

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Command and Scripting Interpreter

          1
          T1059

          Windows Command Shell

          1
          T1059.003

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Defense Evasion

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Peripheral Device Discovery

          1
          T1120

          Query Registry

          1
          T1012

          System Information Discovery

          1
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          System Network Configuration Discovery

          1
          T1016

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          $$a843E.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$a843E.bat
          • Size 722B
          • SHA256 e90ecf8455bb4fabb40a75b527b95c4ae88fad0ef3d50965ff5d7e4fecfbb65d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$a8671.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$a8671.bat
          • Size 722B
          • SHA256 6db93289e8b955359c0f61a871474a44a7da3972493e38452b657b2208803377
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$a87A9.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$a87A9.bat
          • Size 722B
          • SHA256 adeea46495095228e053b54e4fd4ee7073cb854e8fb1717eca0fbebba1829367
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$a8A59.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$a8A59.bat
          • Size 722B
          • SHA256 453791305c67861c2f4ad8d774a182c66c5b9640235f74c85e6d8c7f7ccc98dc
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$a8C4D.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$a8C4D.bat
          • Size 722B
          • SHA256 737f4afa10f7cffe05e7d00058c2c69f14bf035dc665fd39e0b958c3b056a347
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$a8E02.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$a8E02.bat
          • Size 722B
          • SHA256 d34ebf708a2002e8781ae19a41332260afb56d52ec4676c188cfe223342146a0
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$a8FE7.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$a8FE7.bat
          • Size 722B
          • SHA256 582fe461031ff22bce2e7dee0d9dc7ce3ec77fd991958fb6ce26aa7998f0d494
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$a919C.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$a919C.bat
          • Size 722B
          • SHA256 cc42e3949b3f6a977df83f8eac51f62ad53f9ba6721c2c75c78edc60c2514a4c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$a9239.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$a9239.bat
          • Size 722B
          • SHA256 c31a3942c867a861c224963bd5bcafbfc0355a4ee66e581ac89bfc9ecb1033b7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$a93B0.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$a93B0.bat
          • Size 722B
          • SHA256 d4fd527628f01682357b8afa50599f0d7c6f600bcb19ab1e02570367d688f470
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$a9611.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$a9611.bat
          • Size 722B
          • SHA256 db74181f7aac6ce1298a852d8f8329fd2a95df780c4e71a39bd6f0cb711f0e97
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$a9778.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$a9778.bat
          • Size 722B
          • SHA256 f26ff7e319540fa514e62a72248960ecaa209fa3663aeec49c8326ad15b673c9
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$a98E0.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$a98E0.bat
          • Size 722B
          • SHA256 da0c5cd0839771ada830f534d00ed572740b0d68d79457641685cd7f305f6eae
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$a9CC8.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$a9CC8.bat
          • Size 722B
          • SHA256 a25ebc4f458c84280fb44520e59b1886b052dd6a1eb721c1daaa7c6fbd9814f5
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$aA004.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$aA004.bat
          • Size 722B
          • SHA256 2260fe83349d4fa3016ccdf33f858474a454962c124119bb60b01b408ae096bd
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$aA0DF.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$aA0DF.bat
          • Size 722B
          • SHA256 3a73ce2ce6f8a7437a54abaa354754ea63e0bc4f5079f8db204bde51b1e0ac21
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$aA227.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$aA227.bat
          • Size 722B
          • SHA256 c86f3c47d95d22a001bd10f5676c27d87edacbad217ebd9da4d75b72729b376d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$aA3EC.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$aA3EC.bat
          • Size 722B
          • SHA256 4c968eb9a271a0ede8e4219261051205dee296a6ca04d6a2433fbbaeb0ddd2a0
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$aA5A1.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$aA5A1.bat
          • Size 722B
          • SHA256 cd1f00aa28143557ed6d51642466f65eb8b027a81b80b9675cdcb729f691663c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$aA812.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$aA812.bat
          • Size 722B
          • SHA256 1816c9b90d3a59d34e27effefeb4107341687eb26f3756f2fab9c11fef3fc576
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$aA8BE.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$aA8BE.bat
          • Size 722B
          • SHA256 9e2c6efa4c350bf1334bf562a402ced45474d600b2f8e1ddee204f1a9eed3599
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe.exe
          • Size 1.6MB
          • SHA256 dc7cc5535928703109a1396b31adb50a9aeb5d0a74eebe3d450a328ff4661bca
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe.exe
          • Size 1.6MB
          • SHA256 912b2fe3976c9cbb7ae8b0680a66984d213b88e4f120f367b84d285df998f69e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe.exe
          • Size 1.6MB
          • SHA256 0a18c30658976b07632f0aa5425ee4cf5eb61c7cb5ad00d2c4e6d741825f6da1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe.exe
          • Size 1.6MB
          • SHA256 d42351210114845d137b023f0f5573694bf2ec525a231ecbeb091c29cae51789
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe.exe
          • Size 1.5MB
          • SHA256 0bb55d1d48e6abe90b3d8ea37acbb10a651b91eb07cb24ec79247c81296eaaf5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe.exe
          • Size 2.1MB
          • SHA256 94dd2598ebbfe227320bcb4a0ec4bf5d4685f1243f11ad0bf4872f72ced84d19
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe.exe
          • Size 2.0MB
          • SHA256 303a96457055377ef647087212f1ac6d6c08c1275eb42e3db02dce9508e94f28
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe.exe
          • Size 1.9MB
          • SHA256 a7e0ea8b6fde1c13ee38f8d5a451e1d4502eb8ed779b7666091f988bbd3a9d66
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe.exe
          • Size 1.7MB
          • SHA256 bb770aeb1d4f08a2a08fb351a7ffc4f6c4d15b9961b97af20aacaf8ff0c8baa0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe.exe
          • Size 1.5MB
          • SHA256 b55a8cc4c457c5b64b6c56d63d24ebeee6ed2b655a57a7adf6862ecf35c8b5b1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe.exe
          • Size 1.5MB
          • SHA256 b1b11986e6b1d211df97d0dee5359d2e82a760a596e24351344a33bb6c1d86db
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe.exe
          • Size 2.0MB
          • SHA256 8ae224fe3794d0a5217029aef2f96d6c751c3ba40d400dd9adb1b257c640cb40
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe.exe
          • Size 2.0MB
          • SHA256 720e0a389da358bfea61944bdc0bc1353e0785e0efe8e9ad21b27dea9c16414e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe.exe
          • Size 1.8MB
          • SHA256 11f13a874e563e61e3baf7da2459337d1b04a23452f22d13a85dc454edc2baaf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe.exe
          • Size 1.7MB
          • SHA256 b7acecb2f1c655145b970df110dc57822d620ca308032bb749004516f914ddb3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe.exe
          • Size 1.9MB
          • SHA256 7f8b48503b66fdcfb903b1c70a9c49b545276940cad7c4a35d27969cfd8adae0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe.exe
          • Size 1.8MB
          • SHA256 c60881eafc1571f521214d74bc9178068c28efac708705c0d787ff31b2fa0716
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe.exe
          • Size 1.9MB
          • SHA256 41d1388b12fd0072fbfdfaf125a433c3fef80c18d229d380598a0d63d6270b71
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe.exe
          • Size 1.7MB
          • SHA256 9ab6c4b963cb553abaa46a6199703ccd7a50a49f24129cf2e87e5dfbe1672ca2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\426d03a59e9137aa2aa53607a57ce4c07735f2c5307fc57f7e8a6bdf4322e146.exe.exe
          • Size 1.8MB
          • SHA256 089eb18c053fbd664e927be832f528986ea08f7d9e2b28b4c736e3c193c91350
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Logo1_.exe
          • Path C:\Windows\Logo1_.exe
          • Size 32KB
          • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _desktop.ini
          • Path F:\$RECYCLE.BIN\S-1-5-21-1696934516-3600988056-1840298893-1000\_desktop.ini
          • Size 9B
          • SHA256 3b01728e72b5e4110a11234d4a111c8b841e7780c44559315123bbe0fbe10b97
          • MD5 SHA1 SHA512
          Submit Download

          memory/220-6245-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/684-36-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/700-6262-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/700-6258-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/932-5242-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/1148-3937-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/1192-1110-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/1192-1264-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/1200-82-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/1268-20-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/1292-2672-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/1320-3157-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/1416-44-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/1440-6147-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/1792-2044-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/2032-1357-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/2120-1927-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/2296-1614-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/2304-27-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/2380-99-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/2584-5499-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/2628-5668-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/2704-5702-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/2800-13-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/2800-10017-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/2800-8777-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/2800-2452-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/2800-93-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/2896-113-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/2920-4565-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/2984-2811-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/3020-0-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/3020-10-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/3140-6253-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/3180-1913-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/3220-1451-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/3300-57-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/3416-71-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/3424-4249-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/3432-4799-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/3708-5706-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/3796-2967-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/3804-6257-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/3992-2509-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/4024-89-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/4032-6225-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/4220-106-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/4248-5151-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/4308-5710-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/4392-2270-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/4432-5955-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/4544-5021-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/4552-4105-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/4600-1920-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/4780-6233-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/4836-6229-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/4904-5698-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/4908-1446-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/4908-64-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/5072-6237-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/5076-653-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/5088-6241-0x0000000000400000-0x0000000000445000-memory.dmp
          Download