Overview

overview

7

Static

static

3

09f27bf406...a5.exe

windows10-2004-x64

7

09f27bf406...a5.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 07:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
  • Size 3.1MB
  • Sample260930-jml92syhpb
  • SHA256 09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
    "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4912
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a17A5.bat
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:6024
      • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
        "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:2156
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1C96.bat
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4520
          • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
            "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:5972
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1EAA.bat
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:1204
              • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:2636
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a20EC.bat
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:3304
                  • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                    "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:4856
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a22FF.bat
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:236
                      • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                        "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:3676
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a24C4.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:4756
                          • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                            "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of WriteProcessMemory
                            PID:1220
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a26B8.bat
                              14⤵
                              • Executes a command shell one-liner
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:5144
                              • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious use of WriteProcessMemory
                                PID:5848
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a28AC.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:4728
                                  • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                    "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • Suspicious use of WriteProcessMemory
                                    PID:4172
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2ACF.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:3552
                                      • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                        "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:4780
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2D21.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • Suspicious use of WriteProcessMemory
                                          PID:5980
                                          • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                            "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:3236
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a304D.bat
                                              22⤵
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:5112
                                              • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of WriteProcessMemory
                                                PID:4992
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3975.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:2748
                                                  • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:5416
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3B79.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:4100
                                                      • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:2856
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3E86.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:2928
                                                          • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:1364
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4FDB.bat
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:2204
                                                              • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:1336
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a521E.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:4056
                                                                  • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:2024
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5412.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:3392
                                                                      • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:808
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5598.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:3444
                                                                          • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:4864
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5A7A.bat
                                                                              38⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:5480
                                                                              • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:3028
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5C20.bat
                                                                                  40⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:1552
                                                                                  • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:2396
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5DE5.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:3240
                                                                                      • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:2408
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5F2D.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:1828
                                                                                          • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:4316
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6047.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:3196
                                                                                              • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:2280
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6102.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:4696
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:2600
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6AA7.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:2028
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:1864
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6B72.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:3604
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:5140
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6C5C.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:4276
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:3176
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6D85.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:4440
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:4680
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6ECD.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:4296
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:4116
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6FE7.bat
                                                                                                                          60⤵
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:1980
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:5704
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a70D1.bat
                                                                                                                              62⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:1648
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Drops file in Windows directory
                                                                                                                                PID:3224
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a71DB.bat
                                                                                                                                  64⤵
                                                                                                                                    PID:3132
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:2324
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a72C5.bat
                                                                                                                                        66⤵
                                                                                                                                          PID:3232
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                                                            67⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:3848
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a73CF.bat
                                                                                                                                              68⤵
                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:5152
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                                                                69⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                PID:2068
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a749A.bat
                                                                                                                                                  70⤵
                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                  PID:856
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                                                                    71⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                    PID:3612
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7584.bat
                                                                                                                                                      72⤵
                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                      PID:2896
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                                                                        73⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                        PID:5428
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a766E.bat
                                                                                                                                                          74⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:2348
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                                                                            75⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            PID:244
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7768.bat
                                                                                                                                                              76⤵
                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                              PID:4148
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                                                                                77⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                PID:1460
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7843.bat
                                                                                                                                                                  78⤵
                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                  PID:1280
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                                                                                    79⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:1132
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a790E.bat
                                                                                                                                                                      80⤵
                                                                                                                                                                        PID:5708
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                                                                                          81⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          PID:6036
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A08.bat
                                                                                                                                                                            82⤵
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:3068
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                                                                                              83⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:3580
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7AE3.bat
                                                                                                                                                                                84⤵
                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                PID:1528
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                                                                                                  85⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                  PID:3768
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7B9F.bat
                                                                                                                                                                                    86⤵
                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                    PID:5212
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                                                                                                      87⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                      PID:556
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7C79.bat
                                                                                                                                                                                        88⤵
                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                        PID:3536
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                                                                                                          89⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                          PID:3880
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7D35.bat
                                                                                                                                                                                            90⤵
                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            PID:3512
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                                                                                                              91⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                              PID:1932
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E10.bat
                                                                                                                                                                                                92⤵
                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                PID:5724
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                                                                                                                  93⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  PID:3484
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7EBB.bat
                                                                                                                                                                                                    94⤵
                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                    PID:1516
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                                                                                                                      95⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                      PID:1048
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7F87.bat
                                                                                                                                                                                                        96⤵
                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                        PID:4444
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                                                                                                                          97⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                          PID:2608
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8071.bat
                                                                                                                                                                                                            98⤵
                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                            PID:1696
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                                                                                                                              99⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                              PID:2976
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a812C.bat
                                                                                                                                                                                                                100⤵
                                                                                                                                                                                                                  PID:4792
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                                                                                                                                    101⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    PID:6108
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a81F8.bat
                                                                                                                                                                                                                      102⤵
                                                                                                                                                                                                                        PID:2220
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                                                                                                                                          103⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                          PID:4748
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a82C3.bat
                                                                                                                                                                                                                            104⤵
                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                            PID:5080
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                                                                                                                                              105⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              PID:4736
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a83CC.bat
                                                                                                                                                                                                                                106⤵
                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                PID:4872
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                                                                                                                                                  107⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                  PID:4752
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8563.bat
                                                                                                                                                                                                                                    108⤵
                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:3396
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                                                                                                                                                      109⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      PID:3308
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a864D.bat
                                                                                                                                                                                                                                        110⤵
                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                        PID:5420
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                                                                                                                                                          111⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                          PID:720
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8708.bat
                                                                                                                                                                                                                                            112⤵
                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                            PID:3900
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                                                                                                                                                              113⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              PID:3020
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a87C4.bat
                                                                                                                                                                                                                                                114⤵
                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                PID:3952
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                                                                                                                                                                  115⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                  PID:5004
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8860.bat
                                                                                                                                                                                                                                                    116⤵
                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    PID:5148
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                                                                                                                                                                      117⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                      PID:2096
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a890C.bat
                                                                                                                                                                                                                                                        118⤵
                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:2812
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                                                                                                                                                                          119⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                          PID:5604
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a89C8.bat
                                                                                                                                                                                                                                                            120⤵
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            PID:4468
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                                                                                                                                                                              121⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                              PID:1540
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A64.bat
                                                                                                                                                                                                                                                                122⤵
                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                PID:3948
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                                                                                                                                                                                  123⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                  PID:3464
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B3F.bat
                                                                                                                                                                                                                                                                    124⤵
                                                                                                                                                                                                                                                                      PID:2456
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                                                                                                                                                                                        125⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                        PID:2564
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8BEA.bat
                                                                                                                                                                                                                                                                          126⤵
                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                          PID:6136
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                                                                                                                                                                                            127⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                            PID:1532
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C87.bat
                                                                                                                                                                                                                                                                              128⤵
                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                              PID:3364
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                                                                                                                                                                                                129⤵
                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                PID:3080
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D33.bat
                                                                                                                                                                                                                                                                                  130⤵
                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                  PID:4724
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                                                                                                                                                                                                    131⤵
                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                    PID:1844
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8DCF.bat
                                                                                                                                                                                                                                                                                      132⤵
                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                      PID:2336
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                                                                                                                                                                                                        133⤵
                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                        PID:3564
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E6B.bat
                                                                                                                                                                                                                                                                                          134⤵
                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                          PID:5064
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                                                                                                                                                                                                            135⤵
                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            PID:4204
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F07.bat
                                                                                                                                                                                                                                                                                              136⤵
                                                                                                                                                                                                                                                                                                PID:4908
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                                                                                                                                                                                                                  137⤵
                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                  PID:4140
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8FB3.bat
                                                                                                                                                                                                                                                                                                    138⤵
                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                    PID:4788
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                                                                                                                                                                                                                      139⤵
                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                      PID:6040
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a906F.bat
                                                                                                                                                                                                                                                                                                        140⤵
                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                        PID:1896
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                                                                                                                                                                                                                          141⤵
                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                          PID:4508
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a912A.bat
                                                                                                                                                                                                                                                                                                            142⤵
                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                            PID:6016
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                                                                                                                                                                                                                              143⤵
                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                              PID:1284
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a91D6.bat
                                                                                                                                                                                                                                                                                                                144⤵
                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                PID:4888
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                                                                                                                                                                                                                                  145⤵
                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                  PID:2384
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a92A1.bat
                                                                                                                                                                                                                                                                                                                    146⤵
                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                    PID:1248
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                                                                                                                                                                                                                                      147⤵
                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                      PID:5960
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a937C.bat
                                                                                                                                                                                                                                                                                                                        148⤵
                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                        PID:200
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                                                                                                                                                                                                                                          149⤵
                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                          PID:3528
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9418.bat
                                                                                                                                                                                                                                                                                                                            150⤵
                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                            PID:5424
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                                                                                                                                                                                                                                              151⤵
                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                              PID:1904
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a94B4.bat
                                                                                                                                                                                                                                                                                                                                152⤵
                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                PID:4604
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                                                                                                                                                                                                                                                  153⤵
                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                  PID:624
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9560.bat
                                                                                                                                                                                                                                                                                                                                    154⤵
                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                    PID:5324
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                                                                                                                                                                                                                                                      155⤵
                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                      PID:8
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a960C.bat
                                                                                                                                                                                                                                                                                                                                        156⤵
                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                        PID:5308
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                                                                                                                                                                                                                                                          157⤵
                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                          PID:4092
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a96B8.bat
                                                                                                                                                                                                                                                                                                                                            158⤵
                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                            PID:3384
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                                                                                                                                                                                                                                                              159⤵
                                                                                                                                                                                                                                                                                                                                                PID:4708
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9764.bat
                                                                                                                                                                                                                                                                                                                                                  160⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                  PID:1508
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                                                                                                                                                                                                                                                                    161⤵
                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                    PID:5696
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9800.bat
                                                                                                                                                                                                                                                                                                                                                      162⤵
                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                      PID:4080
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                                                                                                                                                                                                                                                                        163⤵
                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                        PID:5548
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a98FA.bat
                                                                                                                                                                                                                                                                                                                                                          164⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                          PID:2620
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                                                                                                                                                                                                                                                                            165⤵
                                                                                                                                                                                                                                                                                                                                                              PID:2540
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9996.bat
                                                                                                                                                                                                                                                                                                                                                                166⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                PID:1000
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe"
                                                                                                                                                                                                                                                                                                                                                                  167⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:1176
                        • C:\Windows\Logo1_.exe
                          C:\Windows\Logo1_.exe
                          2⤵
                          • Creates a file in the Startup directory
                          • Executes dropped EXE
                          • Enumerates connected drives
                          • Drops file in Program Files directory
                          • Drops file in Windows directory
                          • Reads the TCP/IP host and domain name from the registry
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of WriteProcessMemory
                          PID:2960
                          • C:\Windows\SysWOW64\net.exe
                            net stop "Kingsoft AntiVirus Service"
                            3⤵
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of WriteProcessMemory
                            PID:1776
                            • C:\Windows\SysWOW64\net1.exe
                              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                              4⤵
                                PID:2552

                        Network

                              MITRE ATT&CK Enterprise v16

                              Reconnaissance

                              Resource Development

                              Initial Access

                              Execution

                              Command and Scripting Interpreter

                              1
                              T1059

                              Windows Command Shell

                              1
                              T1059.003

                              Persistence

                              Boot or Logon Autostart Execution

                              1
                              T1547

                              Registry Run Keys / Startup Folder

                              1
                              T1547.001

                              Privilege Escalation

                              Boot or Logon Autostart Execution

                              1
                              T1547

                              Registry Run Keys / Startup Folder

                              1
                              T1547.001

                              Defense Evasion

                              Credential Access

                              Credentials from Password Stores

                              1
                              T1555

                              Credentials from Web Browsers

                              1
                              T1555.003

                              Unsecured Credentials

                              1
                              T1552

                              Credentials In Files

                              1
                              T1552.001

                              Discovery

                              Peripheral Device Discovery

                              1
                              T1120

                              Query Registry

                              1
                              T1012

                              System Information Discovery

                              1
                              T1082

                              System Location Discovery

                              1
                              T1614

                              System Language Discovery

                              1
                              T1614.001

                              System Network Configuration Discovery

                              1
                              T1016

                              Lateral Movement

                              Collection

                              Data from Local System

                              1
                              T1005

                              Command and Control

                              Exfiltration

                              Impact

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              $$a17A5.bat
                              • Path C:\Users\Admin\AppData\Local\Temp\$$a17A5.bat
                              • Size 722B
                              • SHA256 4c7dc9c1deb5240ac4b676dd407c75ab50e025760419d25d3fdf1195dff10b94
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              $$a1C96.bat
                              • Path C:\Users\Admin\AppData\Local\Temp\$$a1C96.bat
                              • Size 722B
                              • SHA256 4c06e1234dcad16a2291665d1657a2919e167962e55a7a3e68dfaa0b7a590942
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              $$a1EAA.bat
                              • Path C:\Users\Admin\AppData\Local\Temp\$$a1EAA.bat
                              • Size 722B
                              • SHA256 a4cb1a4479ce85fb2b1515d933c3cd8cf47d56e822e089c9dc4d99a0df32c76f
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              $$a20EC.bat
                              • Path C:\Users\Admin\AppData\Local\Temp\$$a20EC.bat
                              • Size 722B
                              • SHA256 39104172bb322cd88eaf0d42c12fffc4d52d1f2267479f7ac37f825b4dbd1536
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              $$a22FF.bat
                              • Path C:\Users\Admin\AppData\Local\Temp\$$a22FF.bat
                              • Size 722B
                              • SHA256 ecc0eba8c24601cdc96c9ed7e5f16220bc8848c5136c1f8de211583a80e56db0
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              $$a24C4.bat
                              • Path C:\Users\Admin\AppData\Local\Temp\$$a24C4.bat
                              • Size 722B
                              • SHA256 89927816b18f1e3fba5d0ba4938471064dc9417715ece77a150f53d93d29b394
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              $$a26B8.bat
                              • Path C:\Users\Admin\AppData\Local\Temp\$$a26B8.bat
                              • Size 722B
                              • SHA256 f28dbe2d10da66918edd9195c53d55557f228bd455c3c697bf9dc1eb2c1f4176
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              $$a28AC.bat
                              • Path C:\Users\Admin\AppData\Local\Temp\$$a28AC.bat
                              • Size 722B
                              • SHA256 588847dd22f733385f486bca98c153ea986046df63912d8848af5583bccb14c4
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              $$a2ACF.bat
                              • Path C:\Users\Admin\AppData\Local\Temp\$$a2ACF.bat
                              • Size 722B
                              • SHA256 6353ce30613edc592a33bc86dfc4350cec08d0e1e37d83fa16aa8e2445f3237f
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              $$a2D21.bat
                              • Path C:\Users\Admin\AppData\Local\Temp\$$a2D21.bat
                              • Size 722B
                              • SHA256 d2a6fc1ba1fba4c86354dc15e6114e6c8db38a123272085cf7875bd9edb900b4
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              $$a304D.bat
                              • Path C:\Users\Admin\AppData\Local\Temp\$$a304D.bat
                              • Size 722B
                              • SHA256 a0b39bdd533678fc40ce194ef0426d74f8c6c3b076b182ca84256f94c3f61b28
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              $$a3975.bat
                              • Path C:\Users\Admin\AppData\Local\Temp\$$a3975.bat
                              • Size 722B
                              • SHA256 165ad5157dfe21cdca2217d226988492ff8a3f7f5d9cee099b626587b0d5cfea
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              $$a3B79.bat
                              • Path C:\Users\Admin\AppData\Local\Temp\$$a3B79.bat
                              • Size 722B
                              • SHA256 f2c8411435878a2199c7013e10a9af43873295a5936ed3a4fbc613dded403a36
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              $$a3E86.bat
                              • Path C:\Users\Admin\AppData\Local\Temp\$$a3E86.bat
                              • Size 722B
                              • SHA256 0962158b7a0b1355be70e91c8931fe60943892d4a7ac2bd971856cba44a461ef
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              $$a4FDB.bat
                              • Path C:\Users\Admin\AppData\Local\Temp\$$a4FDB.bat
                              • Size 722B
                              • SHA256 3daedc683265c344a2bbefb229a96b44e949564a407417b7669dfaff5970b3f6
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              $$a521E.bat
                              • Path C:\Users\Admin\AppData\Local\Temp\$$a521E.bat
                              • Size 722B
                              • SHA256 28a9eb6d578fc7f85dbaa1c58c23f77921fcb7945755ae18ba515351ac4d3c72
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              $$a5412.bat
                              • Path C:\Users\Admin\AppData\Local\Temp\$$a5412.bat
                              • Size 722B
                              • SHA256 64577db1bf049e2098762d4cdff780255b79d3e6a731abfa00088da36ba6cf04
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              $$a5598.bat
                              • Path C:\Users\Admin\AppData\Local\Temp\$$a5598.bat
                              • Size 722B
                              • SHA256 a68855f61021c73f6be8efe11c70a950cc291e5eea2cf7233b40566cdd57cbb8
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              $$a5A7A.bat
                              • Path C:\Users\Admin\AppData\Local\Temp\$$a5A7A.bat
                              • Size 722B
                              • SHA256 2ec87706cc57147713d4f4a3107174c5c5933968e1f24f25632af58803d0aba7
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              $$a5C20.bat
                              • Path C:\Users\Admin\AppData\Local\Temp\$$a5C20.bat
                              • Size 722B
                              • SHA256 148ac4085bc5fc66da6b1b553f8ca3fa6cf6b71286f41d50688ab9e24e023666
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              $$a5DE5.bat
                              • Path C:\Users\Admin\AppData\Local\Temp\$$a5DE5.bat
                              • Size 722B
                              • SHA256 46057cad43b30cb50a7d9d2d6c059c48da6bfdd733e754b9339a28d294053f07
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe.exe
                              • Size 2.6MB
                              • SHA256 954f0237ebfb518546ed410b9a8ed9d2013d15b872a080359cc44f356ccbdedd
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe.exe
                              • Size 2.5MB
                              • SHA256 393858e1fc940502e9d3f9fefa147b833789890e20a371d35dc300844a00ecb9
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe.exe
                              • Size 2.4MB
                              • SHA256 5c3085d8462a879b8c55357ef73d43fd06fa6d5ef535f33f3cc4f8b079002e58
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe.exe
                              • Size 2.5MB
                              • SHA256 8a12c1b1d7e2fc7ff1bd33643f72badb1f63a0779b272bd31e3dcb538cc119b3
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe.exe
                              • Size 2.4MB
                              • SHA256 bd053d88d322134a5ecbed5520d60df6f6106d459129307f8cf8b6ad8b6130bd
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe.exe
                              • Size 2.6MB
                              • SHA256 47ab8c29594df25ec74e6f78b348128d9c796d0b58f17bd0217eee87ab723a2e
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe.exe
                              • Size 2.5MB
                              • SHA256 1f06ae2c13783e42554e1352604daef35cad62382c67f0510d434d2af4f6bce6
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe.exe
                              • Size 2.7MB
                              • SHA256 c860a96456e1c1200a76d58e24634ab707aa650dae03724052039468962cbb43
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe.exe
                              • Size 3.0MB
                              • SHA256 c6744045b683de33254d9f66479cbe97d7d17629bd8c446d2d826c5896b948b2
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe.exe
                              • Size 3.0MB
                              • SHA256 83d732b15c91f45f3353210f67e59848a28223b8d524c622598893416cbc5eb2
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe.exe
                              • Size 2.6MB
                              • SHA256 80c097d9bf9523d1853744f066a158ea29440e8a63b8680d9d9a27c775b49290
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe.exe
                              • Size 3.0MB
                              • SHA256 140c928385dc497652c4153816d45cd2de5d00f85ee882f6ef775ec2a119b225
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe.exe
                              • Size 2.9MB
                              • SHA256 1f0522c2f6a97183543bf31439f7e0a9b7ae54587d045de455cf7416c59e29dc
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe.exe
                              • Size 2.9MB
                              • SHA256 63aa8eb2d89d03c9a14bc6947d8b32e6d346faf3f2c994c84a28839412e09187
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe.exe
                              • Size 2.9MB
                              • SHA256 baa0ad080a466b358384adbcfa5ed8d391158b058f7521d9ba3ea270a4db32d7
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe.exe
                              • Size 2.8MB
                              • SHA256 96f5ea1bf012abe59402e33e64e174ca6646756e5f55ee52415a99e8e5bfbeea
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe.exe
                              • Size 2.8MB
                              • SHA256 d07c2730b34119f7f9e25f7a7f5f11bf1ef4d00d67db5e643fb48a100e5fef53
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe.exe
                              • Size 2.8MB
                              • SHA256 384cc649c9f7e67d80ec6e2001c0f9d9f6aa993317cfd51a517110b6ac40bac9
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe.exe
                              • Size 2.7MB
                              • SHA256 44a12a7505e92563fd832d516630a5407a078f9647cf51525c66dcebd50546fe
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\09f27bf4062fb88bd90152ad9d499da50594df21ad6a3033487b2e7d7f4ea6a5.exe.exe
                              • Size 2.7MB
                              • SHA256 c3b2114640b59cb5d6e9155204caa9133956a8dc6423d34225f80fc3060501fc
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Logo1_.exe
                              • Path C:\Windows\Logo1_.exe
                              • Size 32KB
                              • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              _desktop.ini
                              • Path F:\$RECYCLE.BIN\S-1-5-21-2251218687-1689653882-3767565116-1000\_desktop.ini
                              • Size 9B
                              • SHA256 3b01728e72b5e4110a11234d4a111c8b841e7780c44559315123bbe0fbe10b97
                              • MD5 SHA1 SHA512
                              Submit Download

                              memory/8-8410-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/244-8194-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/556-8224-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/624-8404-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/720-8284-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/808-5642-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/1048-8244-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/1132-8204-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/1220-2722-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/1220-77-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/1284-8374-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/1336-5609-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/1364-5322-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/1460-8199-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/1532-8325-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/1540-8309-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/1844-8338-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/1864-8132-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/1904-8398-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/1932-8234-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/2024-5617-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/2068-8179-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/2096-8299-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/2156-19-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/2156-24-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/2280-6130-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/2324-8169-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/2384-8380-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/2396-6114-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/2408-6120-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/2540-8441-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/2540-8435-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/2564-8319-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/2600-8127-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/2608-8249-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/2636-43-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/2856-2110-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/2960-99-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/2960-7897-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/2960-12-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/2960-2711-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/2976-8254-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/3020-8289-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/3028-6102-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/3080-8331-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/3176-8142-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/3224-8164-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/3236-213-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/3308-8279-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/3464-8314-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/3484-8239-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/3528-8392-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/3564-8344-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/3580-8214-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/3612-8184-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/3676-65-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/3768-8219-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/3848-8174-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/3880-8229-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/4092-8416-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/4116-8154-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/4140-8356-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/4172-95-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/4204-8350-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/4316-6125-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/4508-8368-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/4680-8149-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/4708-8422-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/4736-8269-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/4748-8264-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/4752-8274-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/4780-104-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/4856-57-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/4864-6094-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/4912-0-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/4912-11-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/4992-1874-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/5004-8294-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/5140-8137-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/5416-1882-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/5428-8189-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/5548-8434-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/5604-8304-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/5696-8428-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/5704-8159-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/5848-85-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/5960-8386-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/5972-34-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/6036-8209-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/6040-8362-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download

                              memory/6108-8259-0x0000000000400000-0x0000000000445000-memory.dmp
                              Download