Overview

overview

7

Static

static

3

5d61e68fdb...8c.exe

windows10-2004-x64

7

5d61e68fdb...8c.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    142s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 15:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
  • Size 2.2MB
  • Sample260930-szsr2aybpe
  • SHA256 5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
    "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4928
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a32E.bat
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4876
      • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
        "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:1204
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a60C.bat
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4884
          • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
            "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:776
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a783.bat
              6⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3956
              • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:3240
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a90A.bat
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:1744
                  • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                    "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:2076
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB6B.bat
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:1648
                      • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                        "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of WriteProcessMemory
                        PID:3844
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD11.bat
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:4280
                          • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                            "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • Suspicious use of WriteProcessMemory
                            PID:3728
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE88.bat
                              14⤵
                              • Executes a command shell one-liner
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:2304
                              • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious use of WriteProcessMemory
                                PID:5808
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF34.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:3436
                                  • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                    "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • Suspicious use of WriteProcessMemory
                                    PID:5728
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a107C.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:5680
                                      • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                        "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • Suspicious use of WriteProcessMemory
                                        PID:3512
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a11A5.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of WriteProcessMemory
                                          PID:5180
                                          • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                            "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of WriteProcessMemory
                                            PID:3944
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a130C.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • Suspicious use of WriteProcessMemory
                                              PID:2836
                                              • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                                "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of WriteProcessMemory
                                                PID:4388
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1454.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:5008
                                                  • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:3292
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a157D.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:1692
                                                      • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:5996
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1677.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:5300
                                                          • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:716
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a17CF.bat
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:5236
                                                              • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:2484
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2116.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:2992
                                                                  • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:4748
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a224E.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:4908
                                                                      • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:1432
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2377.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:2696
                                                                          • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:1360
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2491.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:5456
                                                                              • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:2612
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2D5B.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:4496
                                                                                  • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:4244
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3615.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:4916
                                                                                      • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:3948
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a36C1.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:4516
                                                                                          • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:1320
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a378C.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:2368
                                                                                              • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:5208
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3857.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:2028
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:1020
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3903.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:700
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:4176
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a39AF.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:3304
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:3800
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3D0A.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:1544
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:2756
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3DF5.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:3540
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:3552
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3EC0.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:3804
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:2488
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3F9A.bat
                                                                                                                          60⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:3040
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:5576
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4056.bat
                                                                                                                              62⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:3408
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Drops file in Windows directory
                                                                                                                                PID:5176
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4121.bat
                                                                                                                                  64⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  PID:4044
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                                                                                                                    65⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:4276
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a41AE.bat
                                                                                                                                      66⤵
                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:3412
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                                                                                                                        67⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Drops file in Windows directory
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:5632
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a424A.bat
                                                                                                                                          68⤵
                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                          PID:3544
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                                                                                                                            69⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            PID:4520
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a42F6.bat
                                                                                                                                              70⤵
                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:5688
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                                                                                                                                71⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                PID:1948
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4392.bat
                                                                                                                                                  72⤵
                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:4376
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                                                                                                                                    73⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                    PID:1928
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a442E.bat
                                                                                                                                                      74⤵
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:3504
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                                                                                                                                        75⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                        PID:6124
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4C5C.bat
                                                                                                                                                          76⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:5136
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                                                                                                                                            77⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                            PID:3196
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4CF8.bat
                                                                                                                                                              78⤵
                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                              PID:3520
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                                                                                                                                                79⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:4136
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4DB4.bat
                                                                                                                                                                  80⤵
                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:4024
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                                                                                                                                                    81⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                    PID:1732
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4E50.bat
                                                                                                                                                                      82⤵
                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      PID:2232
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                                                                                                                                                        83⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:2508
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4F4A.bat
                                                                                                                                                                          84⤵
                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          PID:4912
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                                                                                                                                                            85⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                            PID:4016
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5015.bat
                                                                                                                                                                              86⤵
                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                              PID:4312
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                                                                                                                                                                87⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                PID:3200
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a50E0.bat
                                                                                                                                                                                  88⤵
                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                  PID:1780
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                                                                                                                                                                    89⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    PID:4692
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a518C.bat
                                                                                                                                                                                      90⤵
                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:1700
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                                                                                                                                                                        91⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:4512
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5257.bat
                                                                                                                                                                                          92⤵
                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                          PID:6076
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                                                                                                                                                                            93⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            PID:4792
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5303.bat
                                                                                                                                                                                              94⤵
                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                              PID:5124
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                                                                                                                                                                                95⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                PID:2000
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a539F.bat
                                                                                                                                                                                                  96⤵
                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  PID:2788
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                                                                                                                                                                                    97⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:468
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a543C.bat
                                                                                                                                                                                                      98⤵
                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      PID:4492
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                                                                                                                                                                                        99⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                        PID:1496
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a54B9.bat
                                                                                                                                                                                                          100⤵
                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          PID:2520
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                                                                                                                                                                                            101⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            PID:5584
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5555.bat
                                                                                                                                                                                                              102⤵
                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                              PID:1528
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                                                                                                                                                                                                103⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                PID:2904
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5601.bat
                                                                                                                                                                                                                  104⤵
                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  PID:3720
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                                                                                                                                                                                                    105⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                    PID:5360
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a56BC.bat
                                                                                                                                                                                                                      106⤵
                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                      PID:3916
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                                                                                                                                                                                                        107⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                        PID:2716
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5778.bat
                                                                                                                                                                                                                          108⤵
                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                          PID:5272
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                                                                                                                                                                                                            109⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:5024
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5804.bat
                                                                                                                                                                                                                              110⤵
                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              PID:3776
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                                                                                                                                                                                                                111⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                PID:4056
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a58D0.bat
                                                                                                                                                                                                                                  112⤵
                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                  PID:6072
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                                                                                                                                                                                                                    113⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:5112
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a598B.bat
                                                                                                                                                                                                                                      114⤵
                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      PID:2268
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                                                                                                                                                                                                                        115⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                        PID:1048
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5A37.bat
                                                                                                                                                                                                                                          116⤵
                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          PID:5844
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                                                                                                                                                                                                                            117⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                            PID:3492
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5AF2.bat
                                                                                                                                                                                                                                              118⤵
                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:5100
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                                                                                                                                                                                                                                119⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                PID:1652
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5B8F.bat
                                                                                                                                                                                                                                                  120⤵
                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                  PID:4956
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                                                                                                                                                                                                                                    121⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                    PID:5148
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5C1B.bat
                                                                                                                                                                                                                                                      122⤵
                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                      PID:5364
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                                                                                                                                                                                                                                        123⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                        PID:4616
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5CB8.bat
                                                                                                                                                                                                                                                          124⤵
                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          PID:1712
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                                                                                                                                                                                                                                            125⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            PID:3288
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5D92.bat
                                                                                                                                                                                                                                                              126⤵
                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                              PID:4856
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                                                                                                                                                                                                                                                127⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                PID:2092
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5E2F.bat
                                                                                                                                                                                                                                                                  128⤵
                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                  PID:5836
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                                                                                                                                                                                                                                                    129⤵
                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    PID:2812
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5EDA.bat
                                                                                                                                                                                                                                                                      130⤵
                                                                                                                                                                                                                                                                        PID:2420
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                                                                                                                                                                                                                                                          131⤵
                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                          PID:1300
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5F86.bat
                                                                                                                                                                                                                                                                            132⤵
                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                            PID:2752
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe"
                                                                                                                                                                                                                                                                              133⤵
                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                              PID:2708
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6032.bat
                                                                                                                                                                                                                                                                                134⤵
                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                PID:4116
      • C:\Windows\Logo1_.exe
        C:\Windows\Logo1_.exe
        2⤵
        • Creates a file in the Startup directory
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4088
        • C:\Windows\SysWOW64\net.exe
          net stop "Kingsoft AntiVirus Service"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1372
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
            4⤵
              PID:4248

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Command and Scripting Interpreter

            1
            T1059

            Windows Command Shell

            1
            T1059.003

            Persistence

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Privilege Escalation

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Defense Evasion

            Credential Access

            Credentials from Password Stores

            1
            T1555

            Credentials from Web Browsers

            1
            T1555.003

            Unsecured Credentials

            1
            T1552

            Credentials In Files

            1
            T1552.001

            Discovery

            Peripheral Device Discovery

            1
            T1120

            Query Registry

            1
            T1012

            System Information Discovery

            2
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            System Network Configuration Discovery

            1
            T1016

            Lateral Movement

            Collection

            Data from Local System

            1
            T1005

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            $$a107C.bat
            • Path C:\Users\Admin\AppData\Local\Temp\$$a107C.bat
            • Size 722B
            • SHA256 61ed9b65435a48a0e7b32b0cc08b226a5ec516c87540ca1bfc1d48af72e2e821
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            $$a11A5.bat
            • Path C:\Users\Admin\AppData\Local\Temp\$$a11A5.bat
            • Size 722B
            • SHA256 3a7b49fd5529c19d351b5334173a83457994833939bdd6d23e170a1dc28c263b
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            $$a130C.bat
            • Path C:\Users\Admin\AppData\Local\Temp\$$a130C.bat
            • Size 722B
            • SHA256 c6876379f8114eb60f91cb14a3f1c105a63e11c0a0995c2fda217fdf867354c8
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            $$a1454.bat
            • Path C:\Users\Admin\AppData\Local\Temp\$$a1454.bat
            • Size 722B
            • SHA256 af11fcd07bc686a0f56d683360909149571a175134d1945dbb386ecf0fca1803
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            $$a157D.bat
            • Path C:\Users\Admin\AppData\Local\Temp\$$a157D.bat
            • Size 722B
            • SHA256 c0cb33143bd1aedbd08fca53c6fd1d4cbff9c9f82706dba163512712a49b5c16
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            $$a1677.bat
            • Path C:\Users\Admin\AppData\Local\Temp\$$a1677.bat
            • Size 722B
            • SHA256 e3a09a09671ef4d0917e816406c0542d8a4c05d182d134c28d2adac807b59654
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            $$a17CF.bat
            • Path C:\Users\Admin\AppData\Local\Temp\$$a17CF.bat
            • Size 722B
            • SHA256 c569899cd58b077aa83382c272717eb295cb97bc9e6505e1ab2ce391297a8d4b
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            $$a2116.bat
            • Path C:\Users\Admin\AppData\Local\Temp\$$a2116.bat
            • Size 722B
            • SHA256 465309f4ab5a0ba418d0389d27b9c4ac63096c02144d7ae774bfc4fc710ef382
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            $$a224E.bat
            • Path C:\Users\Admin\AppData\Local\Temp\$$a224E.bat
            • Size 722B
            • SHA256 5d578cbaa743cce3f201d716b073ece28c0ea544bb619a399f16a1bab17f5d1f
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            $$a2377.bat
            • Path C:\Users\Admin\AppData\Local\Temp\$$a2377.bat
            • Size 722B
            • SHA256 25da4d871c1e24f86c217a0542181145c87fb15fa9d13f543c5bb664f75384f2
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            $$a2491.bat
            • Path C:\Users\Admin\AppData\Local\Temp\$$a2491.bat
            • Size 722B
            • SHA256 594ae13e81b5b97371210e3f4660f672d8a035d486367beae69904fb4c434afd
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            $$a2D5B.bat
            • Path C:\Users\Admin\AppData\Local\Temp\$$a2D5B.bat
            • Size 722B
            • SHA256 f1598488fac682cb84f116e5444a38840651dac181732a25411c7bd9df51c37a
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            $$a32E.bat
            • Path C:\Users\Admin\AppData\Local\Temp\$$a32E.bat
            • Size 721B
            • SHA256 c867b650838b0946428ce7edb8c358ea93bdf51f1f363867bac1c81e107ed5b2
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            $$a3615.bat
            • Path C:\Users\Admin\AppData\Local\Temp\$$a3615.bat
            • Size 722B
            • SHA256 6fd82a528bad0bdd17d223f9d8d56713ec537066d85ee2763ff7209dcacfd06d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            $$a60C.bat
            • Path C:\Users\Admin\AppData\Local\Temp\$$a60C.bat
            • Size 721B
            • SHA256 bc0fa57063d7f18f12cc5fce0a7be5a88444ff902d306d21f10a3aebb78f4e83
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            $$a783.bat
            • Path C:\Users\Admin\AppData\Local\Temp\$$a783.bat
            • Size 721B
            • SHA256 b10c63c699d10d1c76f76302297b5d3fc6dd10ac9c36a11ac8f3c264b35c7b29
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            $$a90A.bat
            • Path C:\Users\Admin\AppData\Local\Temp\$$a90A.bat
            • Size 721B
            • SHA256 ce5c5fae7e7e76f18e9b87aeb2876472c4cc0fb7fb459243c50d4ae5e94d3bf5
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            $$aB6B.bat
            • Path C:\Users\Admin\AppData\Local\Temp\$$aB6B.bat
            • Size 721B
            • SHA256 368a35c3260eee0efe798915d00a77362dfa1d5bdfd548e82804be171076d1cf
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            $$aD11.bat
            • Path C:\Users\Admin\AppData\Local\Temp\$$aD11.bat
            • Size 721B
            • SHA256 b2f0872423882f5843619854498d7adce47040043ced97deceafd25f16f0cd66
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            $$aE88.bat
            • Path C:\Users\Admin\AppData\Local\Temp\$$aE88.bat
            • Size 721B
            • SHA256 64c8d704e891e5fa290d8c707b643e3af504e875cecf4fa590f9b1fec6a94ed4
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            $$aF34.bat
            • Path C:\Users\Admin\AppData\Local\Temp\$$aF34.bat
            • Size 721B
            • SHA256 ae47281f644ee1c9feae3c27e9f145ad8fcdb363765618f6965b55788a26f481
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe.exe
            • Path C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe.exe
            • Size 1.5MB
            • SHA256 734462cb165b50086aa6adc79ed26cef8f859e4e6cb42de72c38b508a53f3110
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe.exe
            • Path C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe.exe
            • Size 1.6MB
            • SHA256 977b7edcdfc50ed1c0b4985ca79cdfdbec09b03fcecb01887e640af33a6688a5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe.exe
            • Path C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe.exe
            • Size 1.6MB
            • SHA256 65d40d258e6018367805faed143ef60d9d174f07b822ca2bd961da77ca8c41fb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe.exe
            • Path C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe.exe
            • Size 1.8MB
            • SHA256 4febd0844764c98f3be54ea469e1cf1713d678b02f0461341f8a389d14229e1d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe.exe
            • Path C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe.exe
            • Size 2.1MB
            • SHA256 9c70586b3a31665a27217447258590078a670872408258d33e317acd65d22388
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe.exe
            • Path C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe.exe
            • Size 2.1MB
            • SHA256 fd9c7eef0d20e8377c8206e3f40e4475695c6c226b9d7f528bd2b3188883aa7a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe.exe
            • Path C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe.exe
            • Size 1.7MB
            • SHA256 b3b82d8b68af6b514018672a7b32c1d93a7dee672d8e5f8f624f115dd6b4ea2a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe.exe
            • Path C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe.exe
            • Size 2.1MB
            • SHA256 848dc7e4e58b91476ccdf0608b7f73c87e061ab44d0ac938cdcfc525c6cb5a2f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe.exe
            • Path C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe.exe
            • Size 2.0MB
            • SHA256 4531208d826817ac1ac71ff31928933172770500b9dad7e4bd77bb2e4e2914a0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe.exe
            • Path C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe.exe
            • Size 2.0MB
            • SHA256 cb108a46d33fd854a98451f14f3ff144d6baa081e5a59ffa4fd7dd72e621c4b4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe.exe
            • Path C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe.exe
            • Size 2.0MB
            • SHA256 bfdb3c4d1d691890a9f0103a602246239b68d79496e13df48ec80d624cb564b4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe.exe
            • Path C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe.exe
            • Size 1.9MB
            • SHA256 8d60d45c2a7470b161450fe8f075698b030d623b2af1a3a2b7a741481371ae6f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe.exe
            • Path C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe.exe
            • Size 1.9MB
            • SHA256 b719c41d034715c1e4f6598c541807bd67c798fa3fc9eec11ecfe029d52c5bda
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe.exe
            • Path C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe.exe
            • Size 1.9MB
            • SHA256 e648842033cdff8f8f9ce943b2090f75f3ad782aa88012b946d62efd83ad45b6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe.exe
            • Path C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe.exe
            • Size 1.8MB
            • SHA256 04a2038aa18cd6168eb25a9ac0a6f8c638f626109060bec3c98da454131385d0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe.exe
            • Path C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe.exe
            • Size 1.8MB
            • SHA256 a87d8af79889096faca9f8a8dd984c9e189bcfaa9a0acdfb11f731f095e65a16
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe.exe
            • Path C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe.exe
            • Size 1.7MB
            • SHA256 27fb4c9593a34e109688e311bfa20b5c5601814763e19551e5019238a1fe4201
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe.exe
            • Path C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe.exe
            • Size 1.7MB
            • SHA256 72533fe44a232a41c82deba7d536cd8e96ee7d413c5c7359c48e6affe26ba11a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe.exe
            • Path C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe.exe
            • Size 1.6MB
            • SHA256 6cc10588224a1c9350bd61101faa9d21827ea67208e1b653e529727942a017a1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe.exe
            • Path C:\Users\Admin\AppData\Local\Temp\5d61e68fdb52d2e001a6e130f2161e21735f886755b707cc9ece21540bdc2e8c.exe.exe
            • Size 1.5MB
            • SHA256 e64eb8cf2ce4979add30b9df05ae7647537bec007023afe36be78565206cbb20
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Logo1_.exe
            • Path C:\Windows\Logo1_.exe
            • Size 32KB
            • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _desktop.ini
            • Path F:\$RECYCLE.BIN\S-1-5-21-4154726816-2055034831-2297277433-1000\_desktop.ini
            • Size 9B
            • SHA256 3b01728e72b5e4110a11234d4a111c8b841e7780c44559315123bbe0fbe10b97
            • MD5 SHA1 SHA512
            Submit Download

            memory/468-8266-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/716-144-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/776-31-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/1020-5671-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/1048-8311-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/1204-23-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/1300-8354-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/1320-5661-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/1360-1930-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/1432-1922-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/1496-8271-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/1652-8321-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/1732-8223-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/1928-6196-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/1948-6191-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/2000-8261-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/2076-50-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/2076-139-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/2092-8342-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/2484-1906-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/2488-6157-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/2508-8228-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/2612-3896-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/2708-8360-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/2716-8291-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/2756-6147-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/2812-8348-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/2904-8281-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/3196-8213-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/3200-8240-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/3240-41-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/3288-8336-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/3292-127-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/3492-8316-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/3512-100-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/3552-6152-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/3728-72-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/3800-6142-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/3844-64-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/3944-109-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/3948-5656-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/4016-8235-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/4056-8301-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/4088-11-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/4088-3647-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/4088-104-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/4088-8246-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/4136-8218-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/4176-5699-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/4244-5650-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/4276-6176-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/4388-119-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/4512-8251-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/4520-6186-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/4616-8331-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/4692-8245-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/4748-1914-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/4792-8256-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/4928-0-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/4928-12-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/5024-8296-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/5112-8306-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/5148-8326-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/5176-6171-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/5208-5666-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/5360-8286-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/5576-6162-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/5584-8276-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/5632-6181-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/5728-92-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/5808-80-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/5996-135-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/6124-8208-0x0000000000400000-0x0000000000445000-memory.dmp
            Download