Overview

overview

7

Static

static

3

f074e9645c...a5.exe

windows10-2004-x64

7

f074e9645c...a5.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    130s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 17:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
  • Size 3.3MB
  • Sample260930-v5fe1avfld
  • SHA256 f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 44 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
    "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4712
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6C9B.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:772
      • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
        "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5416
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7006.bat
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1584
          • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
            "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2248
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7390.bat
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:252
              • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:4808
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a75D2.bat
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:5232
                  • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                    "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:4108
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a77F5.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4476
                      • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                        "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:2740
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A08.bat
                          12⤵
                          • Executes a command shell one-liner
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:2868
                          • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                            "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • Suspicious use of WriteProcessMemory
                            PID:3668
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7C6A.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:3024
                              • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious use of WriteProcessMemory
                                PID:1288
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E2F.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:3204
                                  • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                    "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:916
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a80A0.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:4256
                                      • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                        "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • Suspicious use of WriteProcessMemory
                                        PID:1224
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8255.bat
                                          20⤵
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of WriteProcessMemory
                                          PID:4520
                                          • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                            "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of WriteProcessMemory
                                            PID:2104
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8DFE.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:3264
                                              • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of WriteProcessMemory
                                                PID:4468
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a91A7.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:3528
                                                  • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:4684
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a93F9.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:4276
                                                      • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:5068
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a960C.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:2696
                                                          • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:2552
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a985E.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:2624
                                                              • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:5320
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A13.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:5136
                                                                  • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:5284
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C17.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:3420
                                                                      • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:4388
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E4A.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:5020
                                                                          • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:3660
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA0AB.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:5976
                                                                              • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:1392
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA32C.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:4820
                                                                                  • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:4556
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA4E1.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:3980
                                                                                      • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:4980
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA687.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:5956
                                                                                          • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:3948
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA7EE.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:4968
                                                                                              • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:460
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA956.bat
                                                                                                  48⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:616
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:484
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA8E.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:5564
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                        51⤵
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:5636
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aABE6.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:1096
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:4288
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD1E.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:5848
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:2720
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE76.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:2164
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:3200
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAFED.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:2924
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:1204
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB1C2.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:5112
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:3088
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB2FA.bat
                                                                                                                              62⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              PID:972
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Drops file in Windows directory
                                                                                                                                PID:1552
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB443.bat
                                                                                                                                  64⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  PID:4780
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                    65⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:6064
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB57B.bat
                                                                                                                                      66⤵
                                                                                                                                        PID:2580
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                          67⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:4280
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB6E2.bat
                                                                                                                                            68⤵
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:704
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                              69⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Drops file in Windows directory
                                                                                                                                              PID:6100
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB83A.bat
                                                                                                                                                70⤵
                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                PID:5704
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                                  71⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                  PID:5844
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB973.bat
                                                                                                                                                    72⤵
                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                    PID:4116
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                                      73⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                      PID:3300
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA4D.bat
                                                                                                                                                        74⤵
                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                        PID:4628
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                                          75⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                          PID:5916
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB76.bat
                                                                                                                                                            76⤵
                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                            PID:5748
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                                              77⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:5856
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC70.bat
                                                                                                                                                                78⤵
                                                                                                                                                                  PID:2448
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                                                    79⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    PID:3860
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBDE7.bat
                                                                                                                                                                      80⤵
                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      PID:4508
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                                                        81⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        PID:5408
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF01.bat
                                                                                                                                                                          82⤵
                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                          PID:3332
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                                                            83⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                            PID:5840
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC058.bat
                                                                                                                                                                              84⤵
                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                              PID:5444
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                                                                85⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                PID:5040
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC162.bat
                                                                                                                                                                                  86⤵
                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                  PID:2968
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                                                                    87⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:1440
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC26C.bat
                                                                                                                                                                                      88⤵
                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                      PID:3828
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                                                                        89⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:4204
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC356.bat
                                                                                                                                                                                          90⤵
                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:4940
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                                                                            91⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            PID:3148
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC450.bat
                                                                                                                                                                                              92⤵
                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                              PID:2388
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                                                                                93⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                PID:5436
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC55A.bat
                                                                                                                                                                                                  94⤵
                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                  PID:5940
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                                                                                    95⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                    PID:2288
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC6A2.bat
                                                                                                                                                                                                      96⤵
                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      PID:5948
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                                                                                        97⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                        PID:260
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC77C.bat
                                                                                                                                                                                                          98⤵
                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                          PID:3500
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                                                                                            99⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                            PID:3656
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC867.bat
                                                                                                                                                                                                              100⤵
                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:3348
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                                                                                                101⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                PID:3936
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC990.bat
                                                                                                                                                                                                                  102⤵
                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                  PID:2556
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                                                                                                    103⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                    PID:1768
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCAE7.bat
                                                                                                                                                                                                                      104⤵
                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                      PID:828
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                                                                                                        105⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        PID:5984
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC10.bat
                                                                                                                                                                                                                          106⤵
                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                          PID:3312
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                                                                                                            107⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:8
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD2A.bat
                                                                                                                                                                                                                              108⤵
                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                              PID:5260
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                                                                                                                109⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                PID:1272
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCE33.bat
                                                                                                                                                                                                                                  110⤵
                                                                                                                                                                                                                                    PID:2792
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                                                                                                                      111⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      PID:3464
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF0E.bat
                                                                                                                                                                                                                                        112⤵
                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                        PID:5528
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                                                                                                                          113⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          PID:3496
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCFF8.bat
                                                                                                                                                                                                                                            114⤵
                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:3532
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                                                                                                                              115⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                              PID:5600
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD0C3.bat
                                                                                                                                                                                                                                                116⤵
                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                PID:4732
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                                                                                                                                  117⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                  PID:2004
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD18F.bat
                                                                                                                                                                                                                                                    118⤵
                                                                                                                                                                                                                                                      PID:2036
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                                                                                                                                        119⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        PID:2424
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD289.bat
                                                                                                                                                                                                                                                          120⤵
                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                          PID:4932
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                                                                                                                                            121⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                            PID:2376
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD334.bat
                                                                                                                                                                                                                                                              122⤵
                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                              PID:3444
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                                                                                                                                                123⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                PID:3760
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD43E.bat
                                                                                                                                                                                                                                                                  124⤵
                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                  PID:5256
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                                                                                                                                                    125⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    PID:896
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD4FA.bat
                                                                                                                                                                                                                                                                      126⤵
                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                      PID:5536
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                                                                                                                                                        127⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                        PID:3800
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD5E4.bat
                                                                                                                                                                                                                                                                          128⤵
                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                          PID:5872
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                                                                                                                                                            129⤵
                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                            PID:4860
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD6EE.bat
                                                                                                                                                                                                                                                                              130⤵
                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                              PID:4660
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                                                                                                                                                                131⤵
                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                PID:1260
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD874.bat
                                                                                                                                                                                                                                                                                  132⤵
                                                                                                                                                                                                                                                                                    PID:3692
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                                                                                                                                                                      133⤵
                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                      PID:3944
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD97E.bat
                                                                                                                                                                                                                                                                                        134⤵
                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                        PID:3040
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                                                                                                                                                                          135⤵
                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                          PID:4516
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA68.bat
                                                                                                                                                                                                                                                                                            136⤵
                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            PID:256
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                                                                                                                                                                              137⤵
                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                              PID:4636
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDB72.bat
                                                                                                                                                                                                                                                                                                138⤵
                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                PID:2228
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                                                                                                                                                                                  139⤵
                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                  PID:364
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC5C.bat
                                                                                                                                                                                                                                                                                                    140⤵
                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                    PID:1324
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                                                                                                                                                                                      141⤵
                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                      PID:4648
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDD47.bat
                                                                                                                                                                                                                                                                                                        142⤵
                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                        PID:5864
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                                                                                                                                                                                          143⤵
                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                          PID:4864
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE50.bat
                                                                                                                                                                                                                                                                                                            144⤵
                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                            PID:3016
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                                                                                                                                                                                              145⤵
                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                              PID:4748
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDF69.bat
                                                                                                                                                                                                                                                                                                                146⤵
                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                PID:1620
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                                                                                                                                                                                                  147⤵
                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                  PID:5820
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE073.bat
                                                                                                                                                                                                                                                                                                                    148⤵
                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                    PID:3784
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                                                                                                                                                                                                      149⤵
                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                      PID:1120
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE14E.bat
                                                                                                                                                                                                                                                                                                                        150⤵
                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                        PID:4552
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                                                                                                                                                                                                          151⤵
                                                                                                                                                                                                                                                                                                                            PID:2312
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE248.bat
                                                                                                                                                                                                                                                                                                                              152⤵
                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                              PID:3832
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                                                                                                                                                                                                                153⤵
                                                                                                                                                                                                                                                                                                                                  PID:3320
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE380.bat
                                                                                                                                                                                                                                                                                                                                    154⤵
                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                    PID:2336
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                                                                                                                                                                                                                      155⤵
                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                      PID:4904
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE46B.bat
                                                                                                                                                                                                                                                                                                                                        156⤵
                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                        PID:5900
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                                                                                                                                                                                                                          157⤵
                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                          PID:5196
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE594.bat
                                                                                                                                                                                                                                                                                                                                            158⤵
                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                            PID:3144
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                                                                                                                                                                                                                              159⤵
                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                              PID:4368
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE69D.bat
                                                                                                                                                                                                                                                                                                                                                160⤵
                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                PID:3068
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                                                                                                                                                                                                                                  161⤵
                                                                                                                                                                                                                                                                                                                                                    PID:4796
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE797.bat
                                                                                                                                                                                                                                                                                                                                                      162⤵
                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                      PID:868
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                                                                                                                                                                                                                                        163⤵
                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                        PID:5860
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE8A1.bat
                                                                                                                                                                                                                                                                                                                                                          164⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                          PID:1656
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                                                                                                                                                                                                                                            165⤵
                                                                                                                                                                                                                                                                                                                                                              PID:1256
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE98B.bat
                                                                                                                                                                                                                                                                                                                                                                166⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                PID:6084
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                                                                                                                                                                                                                                                  167⤵
                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                  PID:5432
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEA66.bat
                                                                                                                                                                                                                                                                                                                                                                    168⤵
                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                    PID:4688
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                                                                                                                                                                                                                                                      169⤵
                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                      PID:4996
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEB50.bat
                                                                                                                                                                                                                                                                                                                                                                        170⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                        PID:1972
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                                                                                                                                                                                                                                                          171⤵
                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                          PID:5072
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEC1B.bat
                                                                                                                                                                                                                                                                                                                                                                            172⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                            PID:5788
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                                                                                                                                                                                                                                                              173⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:5816
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aECF6.bat
                                                                                                                                                                                                                                                                                                                                                                                  174⤵
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  PID:716
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                                                                                                                                                                                                                                                                    175⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                    PID:5100
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEDE1.bat
                                                                                                                                                                                                                                                                                                                                                                                      176⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                      PID:4740
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                                                                                                                                                                                                                                                                        177⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                        PID:1268
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEECB.bat
                                                                                                                                                                                                                                                                                                                                                                                          178⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:2332
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe"
                                                                                                                                                                                                                                                                                                                                                                                              179⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:1476
                                                                        • C:\Windows\Logo1_.exe
                                                                          C:\Windows\Logo1_.exe
                                                                          24⤵
                                                                          • Executes dropped EXE
                                                                          • Enumerates connected drives
                                                                          • Drops file in Windows directory
                                                                          • Reads the TCP/IP host and domain name from the registry
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:2668
                                                                          • C:\Windows\SysWOW64\net.exe
                                                                            net stop "Kingsoft AntiVirus Service"
                                                                            25⤵
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:708
                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                              26⤵
                                                                                PID:2324
                              • C:\Windows\Logo1_.exe
                                C:\Windows\Logo1_.exe
                                2⤵
                                • Executes dropped EXE
                                • Enumerates connected drives
                                • Drops file in Program Files directory
                                • Drops file in Windows directory
                                • Reads the TCP/IP host and domain name from the registry
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:2308
                                • C:\Windows\SysWOW64\net.exe
                                  net stop "Kingsoft AntiVirus Service"
                                  3⤵
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:4396
                                  • C:\Windows\SysWOW64\net1.exe
                                    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                    4⤵
                                      PID:1788
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k GPSvcGroup
                                1⤵
                                  PID:4692

                                Network

                                      MITRE ATT&CK Enterprise v16

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      $$a6C9B.bat
                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a6C9B.bat
                                      • Size 722B
                                      • SHA256 dc833310638505c82a5b35c8d0f0fa9bd731c6d8c2d411ded7f6f62202b77b6e
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      $$a7006.bat
                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a7006.bat
                                      • Size 722B
                                      • SHA256 b84b7a2c5e19df0a4829a81d4f7c8d8b7c1eb005b7bbf859c6d80c22d15275e5
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      $$a7390.bat
                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a7390.bat
                                      • Size 722B
                                      • SHA256 a3baaea3a9570b67c2d2bfb4ced9d40274efeeb671a08c70110f78d4796a834f
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      $$a75D2.bat
                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a75D2.bat
                                      • Size 722B
                                      • SHA256 efd5cb04c2646dc53f3546af865798bdc85af144b3a50ee90a7a26bafbdf9e4c
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      $$a77F5.bat
                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a77F5.bat
                                      • Size 722B
                                      • SHA256 8ddd1b2f39344ed2fa52e85f777416cbe4af28162c8d3a0d200ad3bc8e8cc44d
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      $$a7A08.bat
                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a7A08.bat
                                      • Size 722B
                                      • SHA256 5a15ac649fd69871a08684ca7fc07b0acbb03d411478d7f8f3a19803d9b727e2
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      $$a7C6A.bat
                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a7C6A.bat
                                      • Size 722B
                                      • SHA256 414e6bf3bf8221f8c6287a64e0ed28ea7e88aa5f8d11ae065ad1ec1a4ec9dd1f
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      $$a7E2F.bat
                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a7E2F.bat
                                      • Size 722B
                                      • SHA256 cd87a1b72e10550f17507f3e2ac19c157b4ba339b80b718c6c3b2351f0f0ce9f
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      $$a80A0.bat
                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a80A0.bat
                                      • Size 722B
                                      • SHA256 f6eb45c3f584a010c08442874ae13d9e0e88644c44148e9cf25608d3817edb27
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      $$a8255.bat
                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a8255.bat
                                      • Size 722B
                                      • SHA256 a1a826be165c39d52b809a2f69fa303f53f6511ad1c29018254b8c5a73fba3c1
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      $$a8DFE.bat
                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a8DFE.bat
                                      • Size 722B
                                      • SHA256 c027c67e73846b361eb64ca51562b329952a3bfbcba8dbe0426ced2ddd616991
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      $$a91A7.bat
                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a91A7.bat
                                      • Size 722B
                                      • SHA256 f6b0b02b15db0f16d0f09d0af919344310dc57e344897245b1edcc886492c9d0
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      $$a93F9.bat
                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a93F9.bat
                                      • Size 722B
                                      • SHA256 d1fe8563a091043e97475e6e9f38d69ae16aae86040003dfd3cd01f21e75e4ed
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      $$a960C.bat
                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a960C.bat
                                      • Size 722B
                                      • SHA256 ff4015fbda937956facad794be3b612495a6d8fa96cc4985d851d1278f1ebeb5
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      $$a985E.bat
                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a985E.bat
                                      • Size 722B
                                      • SHA256 c2bdb1a11474f9170956194fb7d101b060e9dc2efde6774452016a287c4f05d1
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      $$a9A13.bat
                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a9A13.bat
                                      • Size 722B
                                      • SHA256 600d5cb68899c760dca44369f49fa8ceeef5db48ed619f5fea54f5389b3e1fc7
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      $$a9C17.bat
                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a9C17.bat
                                      • Size 722B
                                      • SHA256 42de006c50ae8721af61e145a9f0d1d2d7840a144480e2628e7e74dad5e4e23f
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      $$a9E4A.bat
                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a9E4A.bat
                                      • Size 722B
                                      • SHA256 c4c11e89b5a7b856cf591adcad6fb15c73c69b624b057c818223c6abcf08d10d
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe.exe
                                      • Path C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe.exe
                                      • Size 3.2MB
                                      • SHA256 afc2fd5156d0bef5b4c818d96a99a6689159a7e2a08a6ac3852bba68311f11fe
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe.exe
                                      • Path C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe.exe
                                      • Size 3.1MB
                                      • SHA256 ec8026697dd9f2ef038743a0838a5a3dc78aa9d8d402bdddbf8a2c13397ba7b6
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe.exe
                                      • Path C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe.exe
                                      • Size 3.2MB
                                      • SHA256 e9490ae0242d039af061446724dc40d7e2718a08f4e45f3f9a8f04f5ed7c6df3
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe.exe
                                      • Path C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe.exe
                                      • Size 3.1MB
                                      • SHA256 47b5769fa29c5afb34899589aeef909cf0e61b5f2bb6e1fd7287544780e41680
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe.exe
                                      • Path C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe.exe
                                      • Size 3.2MB
                                      • SHA256 76981d10b3a294279e863fc8935d631d0811b380190fe4573ee83062c08a13ba
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe.exe
                                      • Path C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe.exe
                                      • Size 3.0MB
                                      • SHA256 d2a4fc080562ef38b63e3cce14830468f363f092cf29d2ed65ad90b30f48fbc6
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe.exe
                                      • Path C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe.exe
                                      • Size 3.1MB
                                      • SHA256 88951ca83ee12ee37a725bc22d694d59c6545ed168358b8a0613d7b88b9d2a60
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe.exe
                                      • Path C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe.exe
                                      • Size 2.9MB
                                      • SHA256 18dc01f28c2a538b8bbf4b9eba88af2d9ff770364bfaea3ca71af5f7458e06fd
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe.exe
                                      • Path C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe.exe
                                      • Size 3.0MB
                                      • SHA256 3144e634f4f0633675180c3d60ea0f7eb1bf7d6c77b1a3e9c7dea1d7d5753766
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe.exe
                                      • Path C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe.exe
                                      • Size 2.9MB
                                      • SHA256 597fb5c4d00903a1fe97f5662e30163133fa13fd97725b8829b172b78ff0388f
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe.exe
                                      • Path C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe.exe
                                      • Size 2.9MB
                                      • SHA256 c52dbaac99955449d354293f4c9575f208177e649b1257916ca295df7e846992
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe.exe
                                      • Path C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe.exe
                                      • Size 3.0MB
                                      • SHA256 4b1733549f9df381a87a1bc700dd19aeab6be5457d9a0ead3d84ee6abb109699
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe.exe
                                      • Path C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe.exe
                                      • Size 2.8MB
                                      • SHA256 1751e8394988888eee9a4187cc0188434cda558d831afba12f62f908734089b0
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe.exe
                                      • Path C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe.exe
                                      • Size 2.8MB
                                      • SHA256 5b3fd0d247fc60d45c3cb3f7984220a378f4fd069733f02a783748464a942479
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe.exe
                                      • Path C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe.exe
                                      • Size 2.7MB
                                      • SHA256 f07a5bffab54735c5e31ae74feb417f3a54be44f45dc59e8c600246fe9aa03d1
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe.exe
                                      • Path C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe.exe
                                      • Size 2.8MB
                                      • SHA256 07f1f4e70489be9df8b9b1553af3a19455deb83261decf6d33e4afbe04f3baea
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe.exe
                                      • Path C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe.exe
                                      • Size 2.7MB
                                      • SHA256 245ca3d8fc6bf87bcee4c523fb6b5541f1fa7ae5c6a37d7b1310ba5d4f2d60e2
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe.exe
                                      • Path C:\Users\Admin\AppData\Local\Temp\f074e9645cd9b20e0ead394f72c3a03d6de451a51e77fa083f4cf14c1f1c39a5.exe.exe
                                      • Size 2.7MB
                                      • SHA256 1993d5a9206eaaa2e0812fba18722433e8f3adc435e616b6350f4b1d0ad0e949
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      Dll.dll
                                      • Path C:\Windows\Dll.dll
                                      • Size 68KB
                                      • SHA256 58902ae17338af4211e7e21eddb09671507b48740fa7056b9b7f7ab307da0168
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      Logo1_.exe
                                      • Path C:\Windows\Logo1_.exe
                                      • Size 32KB
                                      • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      _desktop.ini
                                      • Path F:\$RECYCLE.BIN\S-1-5-21-461973139-3212354679-1508698038-1000\_desktop.ini
                                      • Size 9B
                                      • SHA256 3b01728e72b5e4110a11234d4a111c8b841e7780c44559315123bbe0fbe10b97
                                      • MD5 SHA1 SHA512
                                      Submit Download

                                      memory/8-1730-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/260-1705-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/364-1817-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/460-1583-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/484-1584-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/896-1775-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/916-93-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/1120-1849-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/1204-1609-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/1224-101-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/1256-1897-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/1260-1793-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/1268-1934-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/1268-1928-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/1272-1735-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/1288-83-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/1392-1562-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/1440-1680-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/1552-1619-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/1768-1720-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/2004-1755-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/2104-1479-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/2248-32-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/2288-1700-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/2308-343-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/2308-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/2308-1481-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/2312-1855-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/2376-1765-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/2424-1760-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/2552-1523-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/2668-1635-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/2668-1568-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/2720-1599-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/2740-63-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/3088-1614-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/3148-1690-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/3200-1604-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/3300-1645-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/3320-1861-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/3464-1740-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/3496-1745-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/3656-1710-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/3660-1557-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/3668-75-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/3760-1770-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/3800-1781-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/3860-1660-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/3936-1715-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/3944-1799-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/3948-1578-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/4108-55-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/4204-1685-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/4280-1629-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/4288-1594-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/4368-1879-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/4388-1549-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/4468-1497-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/4516-1805-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/4556-1567-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/4636-1811-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/4648-1823-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/4684-1505-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/4712-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/4712-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/4748-1835-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/4796-1885-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/4808-41-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/4860-1787-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/4864-1829-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/4904-1867-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/4980-1573-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/4996-1909-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/5040-1675-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/5068-1513-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/5072-1915-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/5100-1927-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/5196-1873-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/5284-1541-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/5320-1533-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/5408-1665-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/5416-648-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/5416-22-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/5432-1903-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/5436-1695-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/5600-1750-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/5636-1589-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/5816-1921-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/5820-1843-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/5820-1837-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/5840-1670-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/5844-1640-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/5856-1655-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/5860-1891-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/5916-1650-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/5984-1725-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/6064-1624-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download

                                      memory/6100-1634-0x0000000000400000-0x0000000000445000-memory.dmp
                                      Download