Overview

overview

7

Static

static

3

2c5ad007f9...90.exe

windows10-2004-x64

7

2c5ad007f9...90.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    127s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 15:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
  • Size 4.3MB
  • Sample260930-s5jfjsvzbx
  • SHA256 2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 44 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 1 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
    "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2680
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6AB6.bat
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:124
      • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
        "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4768
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a70F0.bat
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4812
          • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
            "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2016
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7352.bat
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:5876
              • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:4520
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7565.bat
                  8⤵
                  • Executes a command shell one-liner
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:1532
                  • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                    "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of WriteProcessMemory
                    PID:3628
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7843.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3492
                      • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                        "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of WriteProcessMemory
                        PID:5920
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7AF3.bat
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:2764
                          • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                            "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:1240
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7D73.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:1456
                              • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:5704
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a817B.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:3396
                                  • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                    "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:4228
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D61.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:1684
                                      • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                        "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:4092
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a987D.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • Suspicious use of WriteProcessMemory
                                          PID:4408
                                          • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                            "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • Suspicious use of WriteProcessMemory
                                            PID:1680
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9AA0.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:3692
                                              • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of WriteProcessMemory
                                                PID:2332
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E88.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:4144
                                                  • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:1112
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA0E9.bat
                                                      26⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:4168
                                                      • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:6032
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA31C.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:5000
                                                          • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:1172
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA5DB.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:2240
                                                              • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:3604
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA83C.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:3908
                                                                  • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:6052
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB59.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:5960
                                                                      • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:6020
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD7C.bat
                                                                          36⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:4436
                                                                          • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:4296
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB06A.bat
                                                                              38⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:4252
                                                                              • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:5420
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB23F.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:3020
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:4816
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB329.bat
                                                                                      42⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:3128
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:5348
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB491.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:120
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:1508
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB5E8.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:2920
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:3592
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB711.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:404
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:5976
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB80B.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:2060
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:6004
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB934.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:3248
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:2208
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA5D.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:2844
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:2768
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB67.bat
                                                                                                                  56⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:3608
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:5968
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC90.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:4452
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:1448
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD6A.bat
                                                                                                                          60⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:5932
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            PID:4428
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBEA3.bat
                                                                                                                              62⤵
                                                                                                                                PID:5464
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  PID:4592
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF7E.bat
                                                                                                                                    64⤵
                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:1668
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      PID:2884
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC058.bat
                                                                                                                                        66⤵
                                                                                                                                          PID:2532
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                            67⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:1940
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC143.bat
                                                                                                                                              68⤵
                                                                                                                                                PID:1624
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                  69⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:2740
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC22D.bat
                                                                                                                                                    70⤵
                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                    PID:5516
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                      71⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:2720
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC337.bat
                                                                                                                                                        72⤵
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:4824
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                          73⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                          PID:1352
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC460.bat
                                                                                                                                                            74⤵
                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:3716
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                              75⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:704
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC55A.bat
                                                                                                                                                                76⤵
                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                PID:5608
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                  77⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                  PID:1728
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC6B1.bat
                                                                                                                                                                    78⤵
                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                    PID:2120
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                      79⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                      PID:5196
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC78C.bat
                                                                                                                                                                        80⤵
                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:2644
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                          81⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          PID:1976
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC896.bat
                                                                                                                                                                            82⤵
                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                            PID:4516
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                              83⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:3200
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC9AF.bat
                                                                                                                                                                                84⤵
                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                PID:4200
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                  85⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  PID:3764
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCAC8.bat
                                                                                                                                                                                    86⤵
                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:5860
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                      87⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:4320
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCBA3.bat
                                                                                                                                                                                        88⤵
                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                        PID:3244
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                          89⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          PID:4980
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCCAD.bat
                                                                                                                                                                                            90⤵
                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                            PID:5400
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                              91⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:4476
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD97.bat
                                                                                                                                                                                                92⤵
                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                PID:1436
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                  93⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                  PID:1652
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCEA1.bat
                                                                                                                                                                                                    94⤵
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:4224
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                      95⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                      PID:3156
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF9B.bat
                                                                                                                                                                                                        96⤵
                                                                                                                                                                                                          PID:2260
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                            97⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                            PID:4604
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD075.bat
                                                                                                                                                                                                              98⤵
                                                                                                                                                                                                                PID:2496
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                  99⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  PID:2984
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD160.bat
                                                                                                                                                                                                                    100⤵
                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                    PID:2384
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                      101⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      PID:3664
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD23A.bat
                                                                                                                                                                                                                        102⤵
                                                                                                                                                                                                                          PID:4672
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                            103⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                            PID:3936
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD315.bat
                                                                                                                                                                                                                              104⤵
                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                              PID:3076
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                105⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                PID:5836
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD400.bat
                                                                                                                                                                                                                                  106⤵
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  PID:3088
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                    107⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    PID:2028
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD4FA.bat
                                                                                                                                                                                                                                      108⤵
                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                      PID:4104
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                        109⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                        PID:1084
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD603.bat
                                                                                                                                                                                                                                          110⤵
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          PID:4804
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                            111⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                            PID:3208
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD6FD.bat
                                                                                                                                                                                                                                              112⤵
                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                              PID:4940
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                113⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                PID:2748
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD7D8.bat
                                                                                                                                                                                                                                                  114⤵
                                                                                                                                                                                                                                                    PID:3368
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                      115⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                      PID:5020
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD8D2.bat
                                                                                                                                                                                                                                                        116⤵
                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                        PID:3452
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                          117⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          PID:4440
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD9CC.bat
                                                                                                                                                                                                                                                            118⤵
                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                            PID:1696
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                              119⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                              PID:4500
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDAF5.bat
                                                                                                                                                                                                                                                                120⤵
                                                                                                                                                                                                                                                                  PID:4420
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                    121⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    PID:808
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDBDF.bat
                                                                                                                                                                                                                                                                      122⤵
                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      PID:4612
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                        123⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                        PID:5820
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDCD9.bat
                                                                                                                                                                                                                                                                          124⤵
                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                          PID:2448
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                            125⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            PID:5344
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDDB4.bat
                                                                                                                                                                                                                                                                              126⤵
                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                              PID:2132
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                127⤵
                                                                                                                                                                                                                                                                                  PID:4836
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE9E.bat
                                                                                                                                                                                                                                                                                    128⤵
                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                    PID:4232
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                      129⤵
                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                      PID:3272
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDF89.bat
                                                                                                                                                                                                                                                                                        130⤵
                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                        PID:4324
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                          131⤵
                                                                                                                                                                                                                                                                                            PID:4272
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE054.bat
                                                                                                                                                                                                                                                                                              132⤵
                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                              PID:972
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                                133⤵
                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                PID:1772
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE15D.bat
                                                                                                                                                                                                                                                                                                  134⤵
                                                                                                                                                                                                                                                                                                    PID:2556
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                                      135⤵
                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                      PID:2936
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE257.bat
                                                                                                                                                                                                                                                                                                        136⤵
                                                                                                                                                                                                                                                                                                          PID:1592
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                                            137⤵
                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                            PID:5888
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE323.bat
                                                                                                                                                                                                                                                                                                              138⤵
                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                              PID:3772
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                                                139⤵
                                                                                                                                                                                                                                                                                                                  PID:4328
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE41D.bat
                                                                                                                                                                                                                                                                                                                    140⤵
                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                    PID:5032
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                                                      141⤵
                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                      PID:6040
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE517.bat
                                                                                                                                                                                                                                                                                                                        142⤵
                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                        PID:796
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                                                          143⤵
                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                          PID:4368
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE5F1.bat
                                                                                                                                                                                                                                                                                                                            144⤵
                                                                                                                                                                                                                                                                                                                              PID:4560
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                                                                145⤵
                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                PID:5408
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE6EB.bat
                                                                                                                                                                                                                                                                                                                                  146⤵
                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                  PID:4704
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                                                                    147⤵
                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                    PID:3960
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE805.bat
                                                                                                                                                                                                                                                                                                                                      148⤵
                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                      PID:4116
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                                                                        149⤵
                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                        PID:2704
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE8C0.bat
                                                                                                                                                                                                                                                                                                                                          150⤵
                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                          PID:1440
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                                                                            151⤵
                                                                                                                                                                                                                                                                                                                                              PID:5696
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE98B.bat
                                                                                                                                                                                                                                                                                                                                                152⤵
                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                PID:2872
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                                                                                  153⤵
                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:5312
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEA95.bat
                                                                                                                                                                                                                                                                                                                                                    154⤵
                                                                                                                                                                                                                                                                                                                                                      PID:5784
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                                                                                        155⤵
                                                                                                                                                                                                                                                                                                                                                          PID:2484
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEB50.bat
                                                                                                                                                                                                                                                                                                                                                            156⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                            PID:4124
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                                                                                              157⤵
                                                                                                                                                                                                                                                                                                                                                                PID:3484
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEC3B.bat
                                                                                                                                                                                                                                                                                                                                                                  158⤵
                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                  PID:2620
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                                                                                                    159⤵
                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                    PID:1580
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED06.bat
                                                                                                                                                                                                                                                                                                                                                                      160⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:1948
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                                                                                                          161⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:5096
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEDD1.bat
                                                                                                                                                                                                                                                                                                                                                                              162⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                              PID:1160
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                                                                                                                163⤵
                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                PID:2784
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEEBB.bat
                                                                                                                                                                                                                                                                                                                                                                                  164⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                  PID:2660
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                                                                                                                    165⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                    PID:5328
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEFA6.bat
                                                                                                                                                                                                                                                                                                                                                                                      166⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                      PID:2968
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                                                                                                                        167⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                        PID:4912
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF071.bat
                                                                                                                                                                                                                                                                                                                                                                                          168⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:1840
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                                                                                                                              169⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                              PID:3500
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF14C.bat
                                                                                                                                                                                                                                                                                                                                                                                                170⤵
                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                PID:852
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  171⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1276
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF226.bat
                                                                                                                                                                                                                                                                                                                                                                                                    172⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:2712
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        173⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                        PID:1268
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF301.bat
                                                                                                                                                                                                                                                                                                                                                                                                          174⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:3688
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2864
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF3DC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                  176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5080
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4360
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF4C6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                        178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1588
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4772
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF5A1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5660
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5336
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF69B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                      182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2180
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:768
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF785.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                            184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4784
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5940
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF860.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                    186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4692
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:296
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF93B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                          188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6044
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2636
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF9F6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFAE1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFBAC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFCA6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFD61.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFE3C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFF17.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFFF2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a188.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a243.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a32E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3CA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a495.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a560.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a63B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6E7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7B2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a86D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a967.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA33.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAEE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBAA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC75.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD6F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE2A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF05.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1988
                                                                                                                                                    • C:\Windows\Logo1_.exe
                                                                                                                                                      C:\Windows\Logo1_.exe
                                                                                                                                                      24⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                      • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                      PID:2632
                                                                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                                                                        net stop "Kingsoft AntiVirus Service"
                                                                                                                                                        25⤵
                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                        PID:1452
                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                          C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                          26⤵
                                                                                                                                                            PID:1232
                                                                                                          • C:\Windows\Logo1_.exe
                                                                                                            C:\Windows\Logo1_.exe
                                                                                                            2⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Enumerates connected drives
                                                                                                            • Drops file in Program Files directory
                                                                                                            • Drops file in Windows directory
                                                                                                            • Reads the TCP/IP host and domain name from the registry
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:4952
                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                              net stop "Kingsoft AntiVirus Service"
                                                                                                              3⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:3084
                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                4⤵
                                                                                                                  PID:1928
                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 968
                                                                                                                3⤵
                                                                                                                • Program crash
                                                                                                                PID:4328
                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4952 -ip 4952
                                                                                                            1⤵
                                                                                                              PID:3608

                                                                                                            Network

                                                                                                                  MITRE ATT&CK Enterprise v16

                                                                                                                  Replay Monitor

                                                                                                                  Loading Replay Monitor...

                                                                                                                  Downloads

                                                                                                                  $$a6AB6.bat
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a6AB6.bat
                                                                                                                  • Size 722B
                                                                                                                  • SHA256 d0a248d787041f7ab0e2af4d3676ecf782cf2e72f1298b85dd6fe6db23c5e12b
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  $$a70F0.bat
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a70F0.bat
                                                                                                                  • Size 722B
                                                                                                                  • SHA256 350692eae04a73eb0e5de2772ff0975ec5ed95e961c28337f99ecd57338baa39
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  $$a7352.bat
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a7352.bat
                                                                                                                  • Size 722B
                                                                                                                  • SHA256 be5a4a1da74a97e205f55d09d0d74f293172ac951a85ec892b2a862e1a040ba0
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  $$a7565.bat
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a7565.bat
                                                                                                                  • Size 722B
                                                                                                                  • SHA256 20ecc32f730bf1e0990627bd223f8529d13150754a9625bd0b589c2b07bae48f
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  $$a7843.bat
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a7843.bat
                                                                                                                  • Size 722B
                                                                                                                  • SHA256 3168be36558c3fc55076625544da2ce4a0f65bc9fc3d9b3bf48b5bb7e470633e
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  $$a7AF3.bat
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a7AF3.bat
                                                                                                                  • Size 722B
                                                                                                                  • SHA256 c29cc8e1afef30e7b37bb91eab0cd685a437f701e031dfed7313fa36519f0527
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  $$a7D73.bat
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a7D73.bat
                                                                                                                  • Size 722B
                                                                                                                  • SHA256 363966d13cf62156bfecd65107b3b5d1b363a64fb7462108c2922bd76b60ea2d
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  $$a817B.bat
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a817B.bat
                                                                                                                  • Size 722B
                                                                                                                  • SHA256 ee598fb47ab13e60cdce83a6a386eb04a332781c4924aa55b80fdf12922888fc
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  $$a8D61.bat
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a8D61.bat
                                                                                                                  • Size 722B
                                                                                                                  • SHA256 764a1a832843e7b329a67c677756a10be51bb74abf6e72d65521956dc0369bde
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  $$a987D.bat
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a987D.bat
                                                                                                                  • Size 722B
                                                                                                                  • SHA256 5bbb8c06d3c9c819db4a949e92bee2c22bfa65a9e973fb90d2ccd938806c952f
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  $$a9AA0.bat
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a9AA0.bat
                                                                                                                  • Size 722B
                                                                                                                  • SHA256 911ae73011facc675aec0fea904214c98d2fa165f459b75fc656b30d17ab71c4
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  $$a9E88.bat
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a9E88.bat
                                                                                                                  • Size 722B
                                                                                                                  • SHA256 43cc852e75d0898d0aa1747c282432dac3ce4b6c1d170cd8a7594cbd809de678
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  $$aA0E9.bat
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aA0E9.bat
                                                                                                                  • Size 722B
                                                                                                                  • SHA256 4021fb3a801be4f9d727356af1d01fc47051cc881c83a28362f5279f2376560d
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  $$aA31C.bat
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aA31C.bat
                                                                                                                  • Size 722B
                                                                                                                  • SHA256 c00df127ae7dc1799c5bddd848031b36f7ab800fc6678a31add3cb13c57eee2d
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  $$aA5DB.bat
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aA5DB.bat
                                                                                                                  • Size 722B
                                                                                                                  • SHA256 4e5892705276e2b671daf69ae9441a212904eb3c7da879619f18749321a08912
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  $$aA83C.bat
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aA83C.bat
                                                                                                                  • Size 722B
                                                                                                                  • SHA256 819eee8a265edb5c2e5f41e41b5391a2f787410117570e511f6ac510f7a7377f
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  $$aAB59.bat
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aAB59.bat
                                                                                                                  • Size 722B
                                                                                                                  • SHA256 ae5aafd7f701ebdb8a1435877442a319e7f587dd92aa94278c351bbd9f063ee7
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  $$aAD7C.bat
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aAD7C.bat
                                                                                                                  • Size 722B
                                                                                                                  • SHA256 4b1d18d97b78ebbf5389f7a870a50d396b2fbc81bfb7171ef866220390147fc9
                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                  Submit Download

                                                                                                                  2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe.exe
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe.exe
                                                                                                                  • Size 4.0MB
                                                                                                                  • SHA256 8a1335d2e5f95e3d2b4c40c89a5f1c83f21f4305cdf92112e528ce94e114bbc6
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe.exe
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe.exe
                                                                                                                  • Size 4.2MB
                                                                                                                  • SHA256 6e25caa1edf9f96188f7568bad2ff553c61c96a32118cffbadd9c1adfba21eb3
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe.exe
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe.exe
                                                                                                                  • Size 4.1MB
                                                                                                                  • SHA256 e8b6cba0c1db65d253aeea8eb915c62082a7327e0f8f9de978ef847ec042ec55
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe.exe
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe.exe
                                                                                                                  • Size 4.0MB
                                                                                                                  • SHA256 9c81d74971bfd2b2d05a4d6f49d55c1abe7692ebdf8bc74d6b7edabe7e66ac89
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe.exe
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe.exe
                                                                                                                  • Size 4.2MB
                                                                                                                  • SHA256 43ffcaab19ec2eac66a4915d8d442449749bc1ea0e68ca0c519abb0255e607f5
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe.exe
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe.exe
                                                                                                                  • Size 4.2MB
                                                                                                                  • SHA256 e65e13b8d7b652ca5cbb7c6c3a72160d210bff551e7ea8738f183958bbeea027
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe.exe
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe.exe
                                                                                                                  • Size 4.1MB
                                                                                                                  • SHA256 ed1a914582d4f2f64881d1e2a3f198d045abbf6e073e07bd5ea191df3e7cee85
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe.exe
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe.exe
                                                                                                                  • Size 3.9MB
                                                                                                                  • SHA256 bbd7acea8b6e14807736a052632af19c82a378139f1c6be89c53f985ab2e8893
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe.exe
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe.exe
                                                                                                                  • Size 4.2MB
                                                                                                                  • SHA256 84601c20365ddb1c2abe9bf8f8d3166834d66c9585b0902733c46f68807cc1df
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe.exe
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe.exe
                                                                                                                  • Size 3.8MB
                                                                                                                  • SHA256 f0321d2ef1fa66ee1cd9a89ebb7b381f1b462f279cadcabecf0a47f74f2488c8
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe.exe
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe.exe
                                                                                                                  • Size 4.0MB
                                                                                                                  • SHA256 ef3eb78d40ca15babde4fa09ba91a208f4b5ff7d818157a8fd4e04835d567959
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe.exe
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe.exe
                                                                                                                  • Size 3.9MB
                                                                                                                  • SHA256 8b34e2069f1790e7f7fa84f24cff758bc1bc053b7e84949ea74837de5c4bc5ed
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe.exe
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe.exe
                                                                                                                  • Size 4.1MB
                                                                                                                  • SHA256 1c8f6c095df270f2bc2538153b424d9ec413e21c3e3e669eb7cca1812d2f469d
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe.exe
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe.exe
                                                                                                                  • Size 3.7MB
                                                                                                                  • SHA256 77d7a5361b07aa82ab9c007bb7d25680986ddb7df35259ff5f4e9d2c8c8c0a04
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe.exe
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe.exe
                                                                                                                  • Size 3.9MB
                                                                                                                  • SHA256 bbfe21443f03c9ffcfc72e89515b8ace4d0ff44c4156ffa52a7ce970132936a0
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe.exe
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe.exe
                                                                                                                  • Size 3.8MB
                                                                                                                  • SHA256 1f1d501218029aff6f97096c13b86de7c18434faa614a1e9afe133a4d6e455ba
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe.exe
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe.exe
                                                                                                                  • Size 3.8MB
                                                                                                                  • SHA256 e0450c35fe8c3be985cced36e065f5789322f74443ac2686e7783babf4da46fc
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe.exe
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2c5ad007f9383fe0e1565d67a7790376f83b30ef689445faaab11156efe70390.exe.exe
                                                                                                                  • Size 3.7MB
                                                                                                                  • SHA256 f7bb2ee457276ff1fab7cec49b99abbb12b113726f1dcd7f4db5e69dd4496a51
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  Dll.dll
                                                                                                                  • Path C:\Windows\Dll.dll
                                                                                                                  • Size 68KB
                                                                                                                  • SHA256 58902ae17338af4211e7e21eddb09671507b48740fa7056b9b7f7ab307da0168
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  Logo1_.exe
                                                                                                                  • Path C:\Windows\Logo1_.exe
                                                                                                                  • Size 32KB
                                                                                                                  • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  _desktop.ini
                                                                                                                  • Path F:\$RECYCLE.BIN\S-1-5-21-560646293-820748483-2532804640-1000\_desktop.ini
                                                                                                                  • Size 9B
                                                                                                                  • SHA256 3b01728e72b5e4110a11234d4a111c8b841e7780c44559315123bbe0fbe10b97
                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                  Submit Download

                                                                                                                  memory/296-3371-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/704-3058-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/768-3359-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/808-3174-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/1084-3144-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/1108-3431-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/1112-2908-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/1172-2928-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/1240-79-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/1268-3329-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/1276-3323-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/1352-3053-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/1400-3479-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/1448-3018-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/1508-2982-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/1580-3287-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/1652-3104-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/1676-3491-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/1680-2883-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/1728-3064-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/1772-3208-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/1940-3038-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/1944-3497-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/1976-3074-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/2016-35-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/2028-3139-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/2208-3002-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/2332-2900-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/2360-3503-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/2412-3515-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/2484-3274-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/2632-3059-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/2632-2971-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/2636-3377-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/2640-3389-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/2680-12-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/2680-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/2704-3256-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/2720-3048-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/2740-3043-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/2748-3154-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/2768-3007-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/2784-3299-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/2864-3335-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/2884-3033-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/2896-3485-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/2932-3461-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/2936-3214-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/2984-3119-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/2996-3395-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/3156-3109-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/3200-3079-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/3208-3149-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/3272-3196-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/3484-3280-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/3500-3317-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/3592-2987-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/3604-2936-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/3628-61-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/3664-3124-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/3756-3419-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/3764-3084-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/3800-3449-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/3860-3425-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/3936-3129-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/3960-3250-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4056-3467-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4092-2875-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4228-1850-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4272-3202-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4296-2960-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4320-3089-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4328-3226-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4360-3341-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4368-3238-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4428-3023-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4440-3164-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4464-3407-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4476-3099-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4496-3528-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4496-3534-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4500-3169-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4520-49-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4584-3509-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4592-3028-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4604-3114-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4768-19-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4768-26-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4772-3347-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4816-2970-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4836-3190-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4912-3311-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4916-3413-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4952-2887-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4952-2534-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4952-1254-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4952-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4980-3094-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/5020-3159-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/5040-3473-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/5096-3293-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/5196-3069-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/5204-3383-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/5312-3268-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/5328-3305-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/5336-3353-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/5344-3184-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/5348-2972-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/5348-2977-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/5352-3455-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/5408-3244-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/5420-2965-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/5600-3437-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/5696-3262-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/5704-176-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/5720-3401-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/5780-3527-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/5800-3521-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/5820-3179-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/5824-3443-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/5836-3134-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/5888-3220-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/5920-69-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/5940-3365-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/5968-3012-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/5976-2992-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/6004-2997-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/6020-2952-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/6032-2916-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/6040-3232-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/6052-2944-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                  Download