Overview

overview

7

Static

static

3

958a3246a1...0a.exe

windows10-2004-x64

7

958a3246a1...0a.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    129s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 14:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
  • Size 2.1MB
  • Sample260930-rxhcvasz2m
  • SHA256 958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 58 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 61 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 58 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
    "C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4464
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a46D3.bat
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1952
      • C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
        "C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:4944
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4C22.bat
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:6032
          • C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
            "C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5000
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4E84.bat
              6⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:480
              • C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
                "C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1736
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a53D3.bat
                  8⤵
                  • Executes a command shell one-liner
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:2628
                  • C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
                    "C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:2096
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a572E.bat
                      10⤵
                      • Executes a command shell one-liner
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:4200
                      • C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
                        "C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of WriteProcessMemory
                        PID:5916
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a59CE.bat
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:3596
                          • C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
                            "C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • Suspicious use of WriteProcessMemory
                            PID:2868
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5C6E.bat
                              14⤵
                              • Executes a command shell one-liner
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:1928
                              • C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
                                "C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:4564
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a66A0.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:4520
                                  • C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
                                    "C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:3108
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6874.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:5808
                                      • C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
                                        "C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • Suspicious use of WriteProcessMemory
                                        PID:2492
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a69EB.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • Suspicious use of WriteProcessMemory
                                          PID:2388
                                          • C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
                                            "C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • Suspicious use of WriteProcessMemory
                                            PID:5832
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7DC1.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:4612
                                              • C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
                                                "C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious use of WriteProcessMemory
                                                PID:4764
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8071.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:800
                                                  • C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:2556
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8330.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:3768
                                                      • C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:4304
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8737.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:1988
                                                          • C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:2596
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8989.bat
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:2872
                                                              • C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:5424
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C19.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:6080
                                                                  • C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:1280
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E6B.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:2316
                                                                      • C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:5116
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a966A.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:5252
                                                                          • C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:6064
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a983F.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:1816
                                                                              • C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:2404
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A62.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:3016
                                                                                  • C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:2996
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C36.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:1076
                                                                                      • C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:3516
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9DBD.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:6044
                                                                                          • C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:4516
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E69.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:4584
                                                                                              • C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:3120
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F53.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:5520
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:4720
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA03E.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:4748
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:3168
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA109.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:2340
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:4212
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA1B5.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:3464
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:2344
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA270.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:680
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:4504
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA32C.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:4312
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:3420
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA3C8.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:5736
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:2116
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA464.bat
                                                                                                                              62⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:2012
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Drops file in Windows directory
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:4836
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA53F.bat
                                                                                                                                  64⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:2916
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe"
                                                                                                                                    65⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Drops file in Windows directory
                                                                                                                                    PID:3616
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA5EB.bat
                                                                                                                                      66⤵
                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                      PID:1572
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe"
                                                                                                                                        67⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Drops file in Windows directory
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:1260
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA6B6.bat
                                                                                                                                          68⤵
                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:5540
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe"
                                                                                                                                            69⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            PID:4800
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA771.bat
                                                                                                                                              70⤵
                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:1936
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe"
                                                                                                                                                71⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:3028
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA82D.bat
                                                                                                                                                  72⤵
                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                  PID:5708
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe"
                                                                                                                                                    73⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:3928
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA956.bat
                                                                                                                                                      74⤵
                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:3136
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe"
                                                                                                                                                        75⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                        PID:4320
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA11.bat
                                                                                                                                                          76⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:2824
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe"
                                                                                                                                                            77⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:5484
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAACD.bat
                                                                                                                                                              78⤵
                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:4728
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe"
                                                                                                                                                                79⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:1776
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB79.bat
                                                                                                                                                                  80⤵
                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                  PID:1388
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe"
                                                                                                                                                                    81⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                    PID:3492
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC44.bat
                                                                                                                                                                      82⤵
                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                      PID:3352
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe"
                                                                                                                                                                        83⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                        PID:2772
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aACFF.bat
                                                                                                                                                                          84⤵
                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          PID:2240
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe"
                                                                                                                                                                            85⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                            PID:4756
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD9B.bat
                                                                                                                                                                              86⤵
                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                              PID:5640
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe"
                                                                                                                                                                                87⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                PID:2188
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE47.bat
                                                                                                                                                                                  88⤵
                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  PID:1140
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe"
                                                                                                                                                                                    89⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                    PID:2840
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAEF3.bat
                                                                                                                                                                                      90⤵
                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                      PID:1696
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe"
                                                                                                                                                                                        91⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:4620
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAFAF.bat
                                                                                                                                                                                          92⤵
                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:5740
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe"
                                                                                                                                                                                            93⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                            PID:4220
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB07A.bat
                                                                                                                                                                                              94⤵
                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                              PID:1208
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe"
                                                                                                                                                                                                95⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                PID:4684
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB135.bat
                                                                                                                                                                                                  96⤵
                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                  PID:5772
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe"
                                                                                                                                                                                                    97⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                    PID:2800
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB1C2.bat
                                                                                                                                                                                                      98⤵
                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      PID:2032
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe"
                                                                                                                                                                                                        99⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                        PID:3428
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB27D.bat
                                                                                                                                                                                                          100⤵
                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                          PID:920
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe"
                                                                                                                                                                                                            101⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                            PID:2312
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB329.bat
                                                                                                                                                                                                              102⤵
                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:5600
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe"
                                                                                                                                                                                                                103⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                PID:1668
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB3B6.bat
                                                                                                                                                                                                                  104⤵
                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  PID:2968
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe"
                                                                                                                                                                                                                    105⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                    PID:708
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB471.bat
                                                                                                                                                                                                                      106⤵
                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      PID:3528
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe"
                                                                                                                                                                                                                        107⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                        PID:5528
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB54C.bat
                                                                                                                                                                                                                          108⤵
                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                          PID:4780
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe"
                                                                                                                                                                                                                            109⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:4704
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB637.bat
                                                                                                                                                                                                                              110⤵
                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                              PID:6028
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe"
                                                                                                                                                                                                                                111⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                PID:4740
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB6D3.bat
                                                                                                                                                                                                                                  112⤵
                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                  PID:5140
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe"
                                                                                                                                                                                                                                    113⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:1092
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB77F.bat
                                                                                                                                                                                                                                      114⤵
                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                      PID:1924
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe"
                                                                                                                                                                                                                                        115⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                        PID:1008
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB81B.bat
                                                                                                                                                                                                                                          116⤵
                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                          PID:5012
    • C:\Windows\Logo1_.exe
      C:\Windows\Logo1_.exe
      2⤵
      • Creates a file in the Startup directory
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3204
      • C:\Windows\SysWOW64\net.exe
        net stop "Kingsoft AntiVirus Service"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2716
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
          4⤵
            PID:4876

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Command and Scripting Interpreter

          1
          T1059

          Windows Command Shell

          1
          T1059.003

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Defense Evasion

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Peripheral Device Discovery

          1
          T1120

          Query Registry

          1
          T1012

          System Information Discovery

          2
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          System Network Configuration Discovery

          1
          T1016

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          $$a46D3.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$a46D3.bat
          • Size 722B
          • SHA256 7bda13db09ea0945d685263713c237f39f390a3f334385a7f98b4f2dd1df41c4
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$a4C22.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$a4C22.bat
          • Size 722B
          • SHA256 93e953622b46a11db14950d7d59f9c1a68dc2c9b138a06ccf4bc6a002aea5569
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$a4E84.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$a4E84.bat
          • Size 722B
          • SHA256 97929c0a1a96a1804fe5f09ac0f102c68b37e264c9893cf94ab47087ed3d5128
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$a53D3.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$a53D3.bat
          • Size 722B
          • SHA256 6bd8a9b50fa49631157821b6f238b981ecd971b7f2861b9a0a55dde4873221a6
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$a572E.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$a572E.bat
          • Size 722B
          • SHA256 25c2b350f19756f27fb189ad8c10ec11e1786155c8187b0cd29f1ba6064dc435
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$a59CE.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$a59CE.bat
          • Size 722B
          • SHA256 3dd64f092bddae0dc7149f2e04f95df243b9162325adb3aa786559ee4bb031d4
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$a5C6E.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$a5C6E.bat
          • Size 722B
          • SHA256 38a4322015a3197b245acb98bc66037b34f6daa4fc3784b6b07cb41de368aa57
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$a66A0.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$a66A0.bat
          • Size 722B
          • SHA256 60c1695f7a90252cf5588b927e0449ff8d74466b3f05f08cb73018e663f96a72
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$a6874.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$a6874.bat
          • Size 722B
          • SHA256 3c4c8ec0c22ac2d8270df12eeb775f22c8f6e078661c614dc101b041d90b133b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$a69EB.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$a69EB.bat
          • Size 722B
          • SHA256 fe3692d482d9fddee5755f88cb4b97900ba4d2bd5f6cbc3ad07e1012d66f0764
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$a7DC1.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$a7DC1.bat
          • Size 722B
          • SHA256 cd48e7028d2df1bba7f8807e4cf97ffbb46fd95787bf2f4908232d511ffc7114
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$a8071.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$a8071.bat
          • Size 722B
          • SHA256 f82d70a6cd4b20a774f72678ef42525992795214d626b88dbbe0a78f2a9f22a1
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$a8330.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$a8330.bat
          • Size 722B
          • SHA256 fc3a56db6b102ab9666b2c384977600ae9da67b175dcd92a466ccf01746cecb3
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$a8737.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$a8737.bat
          • Size 722B
          • SHA256 17619d129ebe8f518d4264be23c8d57db16b480c87779ea69a0e5dec1f6c241b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$a8989.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$a8989.bat
          • Size 722B
          • SHA256 e628a39afdee8867668526906e43bd840419aa2a40877febe7d871ad81d0c09d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$a8C19.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$a8C19.bat
          • Size 722B
          • SHA256 814c6c7e2fa1fe976037a853f40464b304bca13398ec1b570c234b544456dec2
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$a8E6B.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$a8E6B.bat
          • Size 722B
          • SHA256 df0f097018a52411ba1cdefe87016910f119a8c46a5e31f9686e4293e5850bbd
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$a966A.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$a966A.bat
          • Size 722B
          • SHA256 e2e1356525bf16ccca8b2585fa7291b42024b2490f68f52747f015fad34d5722
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$a983F.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$a983F.bat
          • Size 722B
          • SHA256 8784808715c8f987b12439d14024e689527294d57651513f0a344cb5a8372c82
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$a9A62.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$a9A62.bat
          • Size 722B
          • SHA256 3f6a5ccdb51c145b0f94340704c687d8d19c7bff811b941966cd2e37c3227e70
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$a9C36.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$a9C36.bat
          • Size 722B
          • SHA256 b17878033ad1408ff4853ee6e2d4f4aeced5d715b4a06bf39a1ea9a92eec42dc
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
          • Path C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe
          • Size 1.5MB
          • SHA256 bd7a95e0aeb46c3b3a3304cb89ed07589173e9d01ee72d4f84db441f930d7b58
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe.exe
          • Size 1.7MB
          • SHA256 01b5ee1b3ae3c75c7b009bde154fa8c5cdba7d8cd9c5560689803a72443d61e5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe.exe
          • Size 1.6MB
          • SHA256 bf51a34a584d14bd929933e2719aa629652cd80d2d1f40a6fe9bdea0e4f6bd02
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe.exe
          • Size 1.7MB
          • SHA256 ec0cddb8b9576e661998f9256e339fe53968fa129d5c6973ce790483ee7209f0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe.exe
          • Size 1.6MB
          • SHA256 e04f1f93f79b5f599bdb7bf151e070abc4273426d70ae5ac23cc717a42bde786
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe.exe
          • Size 1.4MB
          • SHA256 23e195b040a49f470062feb9e2b0a18439ad9868bb152fe7fba909b4d17f1d4c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe.exe
          • Size 1.6MB
          • SHA256 9e4295dada1736d53b2bebab39f039e96316a88ae1608619dba20f1f13c0d547
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe.exe
          • Size 1.5MB
          • SHA256 cd1c08fcb913b76b91dc8b1230a584adb353f36120a2f6ef6f183b827c8fb0db
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe.exe
          • Size 2.1MB
          • SHA256 304b8425f8d8afb8714b1d44e9adf3eb22da129eb968748053b0be7f47ea46ec
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe.exe
          • Size 1.8MB
          • SHA256 635595df509ac2610b04717a0cca81fd19cb0618c4bc5c966586b4220e7ed36e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe.exe
          • Size 1.8MB
          • SHA256 ae85e0d4d090c835cc43f16e468d832e6a77f7fbdae1ed8cc544820c01fbed9b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe.exe
          • Size 1.5MB
          • SHA256 a7d0337875d9f39fed317f1906f5ed8e2aa92f819422affe01ebd80876d34dcf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe.exe
          • Size 1.7MB
          • SHA256 f1c45ab368254925916318abcc3e7198ab483f939b86ebf1f6d35ca59b0d5423
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe.exe
          • Size 1.9MB
          • SHA256 2011df0ab9ec3785a23baa3c2994af0c9f833382644e4234dc0f3311a41fcfdb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe.exe
          • Size 2.0MB
          • SHA256 7b1783c99ab93d9e031c79d4fe7c38dd5cc69ce7e0639f1f656ecd5d02742eb5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe.exe
          • Size 1.8MB
          • SHA256 a948f8f6cf7e590fbd4364b5195b79d5e1402ea67fc88c455fcf224c7afb73d0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe.exe
          • Size 1.9MB
          • SHA256 fb6501d343b38030dee5e49a42853b350068e78f30e3196a84896cefeb45b927
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe.exe
          • Size 2.0MB
          • SHA256 974faa98e33c01936e99a951fd8feafc8e7e392511896d42eeebc2d94737d280
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe.exe
          • Size 2.0MB
          • SHA256 d814f89b2a94eeed61080c4c7fdfe397e0960887af08ab052cfd815abfc15f5b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\958a3246a189da07422d0b1b9d0fa2fe6c04c3b8249fa08951561649e700c40a.exe.exe
          • Size 1.9MB
          • SHA256 cd6d0474ee1be69fcb4f6637e09bcfb01e85b3b94fb036bb7f5e502b8c1897a6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Logo1_.exe
          • Path C:\Windows\Logo1_.exe
          • Size 32KB
          • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _desktop.ini
          • Path F:\$RECYCLE.BIN\S-1-5-21-1404337215-1550464601-2805570857-1000\_desktop.ini
          • Size 9B
          • SHA256 3b01728e72b5e4110a11234d4a111c8b841e7780c44559315123bbe0fbe10b97
          • MD5 SHA1 SHA512
          Submit Download

          memory/708-8279-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/1008-8300-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/1008-8305-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/1092-8299-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/1260-8184-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/1280-6080-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/1668-8274-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/1736-48-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/1776-8214-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/2096-60-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/2116-8169-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/2188-8234-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/2312-8269-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/2344-8154-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/2404-8110-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/2492-1857-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/2556-5583-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/2596-6060-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/2772-8224-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/2800-8259-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/2840-8239-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/2868-102-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/2996-8118-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/3028-8194-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/3108-1849-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/3120-8134-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/3168-8144-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/3204-2850-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/3204-10-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/3204-1055-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/3204-8085-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/3204-8306-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/3420-8164-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/3428-8264-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/3492-8219-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/3516-8124-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/3616-8179-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/3928-8199-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/4212-8149-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/4220-8249-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/4304-6052-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/4320-8204-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/4464-13-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/4464-0-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/4504-8159-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/4516-8129-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/4564-1841-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/4620-8244-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/4684-8254-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/4704-8289-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/4720-8139-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/4740-8294-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/4756-8229-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/4764-5575-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/4800-8189-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/4836-8174-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/4944-25-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/5000-34-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/5116-8092-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/5424-6072-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/5484-8209-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/5528-8284-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/5832-5228-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/5916-70-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/6064-8100-0x0000000000400000-0x0000000000445000-memory.dmp
          Download