Overview

overview

7

Static

static

3

6eb34a8bf4...a9.exe

windows10-2004-x64

7

6eb34a8bf4...a9.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/10/2026, 22:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
  • Size 4.1MB
  • Sample261002-2g47saxtcv
  • SHA256 6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 44 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 1 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
    "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5456
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3658.bat
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4872
      • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
        "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:6104
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a39A4.bat
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2204
          • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
            "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:5240
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3D3E.bat
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:2432
              • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:1464
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3F41.bat
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:3716
                  • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                    "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:4432
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4155.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:5532
                      • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                        "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of WriteProcessMemory
                        PID:124
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4397.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:428
                          • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                            "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:1892
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a45AA.bat
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:6124
                              • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious use of WriteProcessMemory
                                PID:3372
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a47AE.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:552
                                  • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                    "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:2256
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a49D1.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:4660
                                      • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                        "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:1376
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4BD4.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:4056
                                          • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                            "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of WriteProcessMemory
                                            PID:5376
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a50C6.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • Suspicious use of WriteProcessMemory
                                              PID:6020
                                              • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of WriteProcessMemory
                                                PID:3468
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a575D.bat
                                                  24⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:5716
                                                  • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:5256
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5A99.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:3120
                                                      • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:2532
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5CCC.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:4576
                                                          • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:5340
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a645D.bat
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:1076
                                                              • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:4936
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6894.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:1484
                                                                  • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:5180
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6A97.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:4356
                                                                      • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:5124
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6C9B.bat
                                                                          36⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:4652
                                                                          • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:5072
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6E9E.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:2908
                                                                              • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:4740
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7083.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:5216
                                                                                  • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:3608
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a714E.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:4280
                                                                                      • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:1384
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7248.bat
                                                                                          44⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:5516
                                                                                          • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:1584
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7332.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:4668
                                                                                              • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:3720
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a745B.bat
                                                                                                  48⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:4116
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:6004
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7565.bat
                                                                                                      50⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:2988
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:5756
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a768E.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:240
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:2144
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7797.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:300
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:5852
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7882.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:2092
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:3460
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a797C.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:1272
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:2768
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A37.bat
                                                                                                                          60⤵
                                                                                                                            PID:4292
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                              61⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:1592
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7B12.bat
                                                                                                                                62⤵
                                                                                                                                  PID:2976
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                    63⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Drops file in Windows directory
                                                                                                                                    PID:4544
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7BED.bat
                                                                                                                                      64⤵
                                                                                                                                        PID:1972
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                          65⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Drops file in Windows directory
                                                                                                                                          PID:5520
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7CC7.bat
                                                                                                                                            66⤵
                                                                                                                                              PID:3584
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                67⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:4608
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7DA2.bat
                                                                                                                                                  68⤵
                                                                                                                                                    PID:4864
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                      69⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                      PID:4316
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7EAC.bat
                                                                                                                                                        70⤵
                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                        PID:4896
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                          71⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:1948
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7F87.bat
                                                                                                                                                            72⤵
                                                                                                                                                              PID:4496
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                73⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                PID:4492
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8081.bat
                                                                                                                                                                  74⤵
                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:5936
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                    75⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                    PID:4868
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a816B.bat
                                                                                                                                                                      76⤵
                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                      PID:3408
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                        77⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                        PID:4968
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8226.bat
                                                                                                                                                                          78⤵
                                                                                                                                                                            PID:1964
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                              79⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              PID:2604
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a82F2.bat
                                                                                                                                                                                80⤵
                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                PID:1508
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                  81⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  PID:2744
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a83DC.bat
                                                                                                                                                                                    82⤵
                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                    PID:5960
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                      83⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:3876
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a84B7.bat
                                                                                                                                                                                        84⤵
                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:4420
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                          85⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          PID:708
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8582.bat
                                                                                                                                                                                            86⤵
                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                            PID:3096
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                              87⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                              PID:4804
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a867C.bat
                                                                                                                                                                                                88⤵
                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                PID:4468
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                  89⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  PID:2424
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8766.bat
                                                                                                                                                                                                    90⤵
                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:5460
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                      91⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      PID:3376
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8870.bat
                                                                                                                                                                                                        92⤵
                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                        PID:6084
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                          93⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          PID:2004
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a891C.bat
                                                                                                                                                                                                            94⤵
                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                            PID:4220
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                              95⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:1084
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a89E7.bat
                                                                                                                                                                                                                96⤵
                                                                                                                                                                                                                  PID:4848
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                    97⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                    PID:4236
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8AF0.bat
                                                                                                                                                                                                                      98⤵
                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                      PID:5388
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                        99⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                        PID:3820
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8BCB.bat
                                                                                                                                                                                                                          100⤵
                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                          PID:1316
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                            101⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:3308
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C96.bat
                                                                                                                                                                                                                              102⤵
                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                              PID:6080
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                103⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                PID:5412
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D81.bat
                                                                                                                                                                                                                                  104⤵
                                                                                                                                                                                                                                    PID:1104
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                      105⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      PID:5476
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E5B.bat
                                                                                                                                                                                                                                        106⤵
                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                        PID:3320
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                          107⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                          PID:1524
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F55.bat
                                                                                                                                                                                                                                            108⤵
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:4520
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                              109⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:5924
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a905F.bat
                                                                                                                                                                                                                                                110⤵
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                PID:4912
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                  111⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  PID:6100
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a911B.bat
                                                                                                                                                                                                                                                    112⤵
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    PID:3852
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                      113⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      PID:1276
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9224.bat
                                                                                                                                                                                                                                                        114⤵
                                                                                                                                                                                                                                                          PID:484
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                            115⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            PID:6048
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a92FF.bat
                                                                                                                                                                                                                                                              116⤵
                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                              PID:5644
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                117⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                PID:1236
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a93DA.bat
                                                                                                                                                                                                                                                                  118⤵
                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                  PID:1516
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                    119⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    PID:5088
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a94C4.bat
                                                                                                                                                                                                                                                                      120⤵
                                                                                                                                                                                                                                                                        PID:3664
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                          121⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                          PID:3356
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9580.bat
                                                                                                                                                                                                                                                                            122⤵
                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                            PID:2792
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                              123⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              PID:5628
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a962B.bat
                                                                                                                                                                                                                                                                                124⤵
                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                PID:5600
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                  125⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                  PID:5496
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a96E7.bat
                                                                                                                                                                                                                                                                                    126⤵
                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                    PID:2984
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                      127⤵
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      PID:5320
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a97B2.bat
                                                                                                                                                                                                                                                                                        128⤵
                                                                                                                                                                                                                                                                                          PID:4372
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                            129⤵
                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            PID:464
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a985E.bat
                                                                                                                                                                                                                                                                                              130⤵
                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                              PID:1156
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                131⤵
                                                                                                                                                                                                                                                                                                  PID:3904
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9939.bat
                                                                                                                                                                                                                                                                                                    132⤵
                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                    PID:4956
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                      133⤵
                                                                                                                                                                                                                                                                                                        PID:2588
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a99F4.bat
                                                                                                                                                                                                                                                                                                          134⤵
                                                                                                                                                                                                                                                                                                            PID:3528
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                              135⤵
                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                              PID:3184
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9AB0.bat
                                                                                                                                                                                                                                                                                                                136⤵
                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                PID:3748
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                  137⤵
                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                  PID:4744
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B8A.bat
                                                                                                                                                                                                                                                                                                                    138⤵
                                                                                                                                                                                                                                                                                                                      PID:2500
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                        139⤵
                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                        PID:3264
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C46.bat
                                                                                                                                                                                                                                                                                                                          140⤵
                                                                                                                                                                                                                                                                                                                            PID:2112
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                              141⤵
                                                                                                                                                                                                                                                                                                                                PID:1852
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D01.bat
                                                                                                                                                                                                                                                                                                                                  142⤵
                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                  PID:5864
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                    143⤵
                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                    PID:5880
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9DCD.bat
                                                                                                                                                                                                                                                                                                                                      144⤵
                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                      PID:1932
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                        145⤵
                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                        PID:1536
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9EC7.bat
                                                                                                                                                                                                                                                                                                                                          146⤵
                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                          PID:1428
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                            147⤵
                                                                                                                                                                                                                                                                                                                                              PID:5780
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9FA1.bat
                                                                                                                                                                                                                                                                                                                                                148⤵
                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                PID:1500
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                  149⤵
                                                                                                                                                                                                                                                                                                                                                    PID:2448
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA06C.bat
                                                                                                                                                                                                                                                                                                                                                      150⤵
                                                                                                                                                                                                                                                                                                                                                        PID:2716
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                          151⤵
                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                          PID:1944
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA138.bat
                                                                                                                                                                                                                                                                                                                                                            152⤵
                                                                                                                                                                                                                                                                                                                                                              PID:4732
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                153⤵
                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                PID:3880
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA1F3.bat
                                                                                                                                                                                                                                                                                                                                                                  154⤵
                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                  PID:3784
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                    155⤵
                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                    PID:760
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA2BE.bat
                                                                                                                                                                                                                                                                                                                                                                      156⤵
                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                      PID:1832
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                        157⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:2860
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA389.bat
                                                                                                                                                                                                                                                                                                                                                                            158⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                            PID:4728
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                              159⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:2580
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA464.bat
                                                                                                                                                                                                                                                                                                                                                                                  160⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                  PID:5512
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                    161⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                    PID:1636
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA53F.bat
                                                                                                                                                                                                                                                                                                                                                                                      162⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                      PID:3068
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                        163⤵
                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                        PID:5996
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA5FA.bat
                                                                                                                                                                                                                                                                                                                                                                                          164⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                          PID:1460
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                            165⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:5248
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA6D5.bat
                                                                                                                                                                                                                                                                                                                                                                                                166⤵
                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                PID:1504
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  167⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                  PID:4436
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA771.bat
                                                                                                                                                                                                                                                                                                                                                                                                    168⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                    PID:2916
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      169⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                      PID:2568
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA81D.bat
                                                                                                                                                                                                                                                                                                                                                                                                        170⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                        PID:2200
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          171⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:5344
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA908.bat
                                                                                                                                                                                                                                                                                                                                                                                                              172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4380
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2148
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA9D3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                      174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3188
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4052
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA8E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                          176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3052
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:264
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB3A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                  178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1968
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4832
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aABD6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                      180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1168
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5992
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC92.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                          182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3492
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5452
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD2E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                              184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1368
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2428
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aADCA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                    186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5876
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4120
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE86.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                        188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:476
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5892
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF9F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                              190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5364
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB0B8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB155.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB1F1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB28D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB31A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB3B6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB452.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB4EE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB57B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB617.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB694.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB740.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB7BD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB84A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB8D6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB973.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB9FF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA9C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB19.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBBA5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4416
                                                                                                                                                                  • C:\Windows\Logo1_.exe
                                                                                                                                                                    C:\Windows\Logo1_.exe
                                                                                                                                                                    32⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                    • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                    PID:5536
                                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                      net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                      33⤵
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                      PID:3128
                                                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                        34⤵
                                                                                                                                                                          PID:5628
                                                                                                        • C:\Windows\Logo1_.exe
                                                                                                          C:\Windows\Logo1_.exe
                                                                                                          2⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • Enumerates connected drives
                                                                                                          • Drops file in Program Files directory
                                                                                                          • Drops file in Windows directory
                                                                                                          • Reads the TCP/IP host and domain name from the registry
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:3588
                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                            net stop "Kingsoft AntiVirus Service"
                                                                                                            3⤵
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:1112
                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                              4⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              PID:2612
                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 956
                                                                                                            3⤵
                                                                                                            • Program crash
                                                                                                            PID:3056
                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3588 -ip 3588
                                                                                                        1⤵
                                                                                                          PID:4540

                                                                                                        Network

                                                                                                              MITRE ATT&CK Enterprise v16

                                                                                                              Replay Monitor

                                                                                                              Loading Replay Monitor...

                                                                                                              Downloads

                                                                                                              $$a3658.bat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a3658.bat
                                                                                                              • Size 722B
                                                                                                              • SHA256 9e28229fa69548bead571f602944e8314c3e37a6ceeeaea54b9fd99f32d0cce4
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              $$a39A4.bat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a39A4.bat
                                                                                                              • Size 722B
                                                                                                              • SHA256 adbc6a8c0b53b5bfe29bbb15c6d69b5b113f071fe06626164858305d10dfd390
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              $$a3D3E.bat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a3D3E.bat
                                                                                                              • Size 722B
                                                                                                              • SHA256 eac7d2adf65fe4374ac2666f4b74e875f51ab5c268d0acc20258538c900746cd
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              $$a3F41.bat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a3F41.bat
                                                                                                              • Size 722B
                                                                                                              • SHA256 a0a5c8129354585f616fd3399bfb4322bb6f1dc4ad2154bd2cc63c8142e62fcb
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              $$a4155.bat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a4155.bat
                                                                                                              • Size 722B
                                                                                                              • SHA256 859d04781a2d659e28c0c0466d0cc5818991366a485e56420037f717ff40b850
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              $$a4397.bat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a4397.bat
                                                                                                              • Size 722B
                                                                                                              • SHA256 83b82f82308d7f9d5df8c205dbf900452f85968cdd605bc85882b59fbb0a4a9e
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              $$a45AA.bat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a45AA.bat
                                                                                                              • Size 722B
                                                                                                              • SHA256 90f7d3250c9f89eecbb4094559b1dcee027afefef93aec421018b7fe66d16168
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              $$a47AE.bat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a47AE.bat
                                                                                                              • Size 722B
                                                                                                              • SHA256 86f623dc99bf691d6793ec11db40ee139f7483bd9c5b794765e7c339128d1031
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              $$a49D1.bat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a49D1.bat
                                                                                                              • Size 722B
                                                                                                              • SHA256 ff478549c1b47a46197ba7456fe64166ddfb8feb8113784dd56bbf4ebded5514
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              $$a4BD4.bat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a4BD4.bat
                                                                                                              • Size 722B
                                                                                                              • SHA256 3e743bace3fdb3995a2f1c35ef777beb9111e4ac04bf47d77545a262e4480a74
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              $$a50C6.bat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a50C6.bat
                                                                                                              • Size 722B
                                                                                                              • SHA256 f95c8b172255a3b27b894a4ecc00520ebaf918e292e880680e969f72c9bce082
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              $$a575D.bat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a575D.bat
                                                                                                              • Size 722B
                                                                                                              • SHA256 6a621b92d95d3f09e86bc60f490335190434b9a317758c090381f37bcd38e733
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              $$a5A99.bat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a5A99.bat
                                                                                                              • Size 722B
                                                                                                              • SHA256 b63886f62d32298de5ebd41390b37d311b44a4b238a2701e142b92137cb88cbc
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              $$a5CCC.bat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a5CCC.bat
                                                                                                              • Size 722B
                                                                                                              • SHA256 77310dacaea9ecd884eeaa6c2d99de619d6cf67d16848b3a4a24f45865bd6749
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              $$a645D.bat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a645D.bat
                                                                                                              • Size 722B
                                                                                                              • SHA256 463f2944c6c54bf8808943849a0e9ac22ab30bdc77a06cdfd8cbf9f7c978968e
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              $$a6894.bat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a6894.bat
                                                                                                              • Size 722B
                                                                                                              • SHA256 16d75dab0aa16f69d14009b6cfcaf5194d24d4b657a4e2da7b34af1666c27225
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              $$a6A97.bat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a6A97.bat
                                                                                                              • Size 722B
                                                                                                              • SHA256 c05a894d5e8fcd1cbc175997b69e5590aa23e5012977fc18b490043aeb13d975
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              $$a6C9B.bat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a6C9B.bat
                                                                                                              • Size 722B
                                                                                                              • SHA256 7ec0acb800c760c13efc3c02237963e348e109a761aaa1bb53f73e05a1c6bac7
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              $$a6E9E.bat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a6E9E.bat
                                                                                                              • Size 722B
                                                                                                              • SHA256 8af101851ba9f4254b016541acdd27ce23e9ac366b84795c9258853be56c48ae
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                              • Size 3.7MB
                                                                                                              • SHA256 53cc17f668fc08a983d28debd5658442d23649ad239d005f92e86274d3583e07
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                              • Size 3.7MB
                                                                                                              • SHA256 d7b9d967d88d6c945ffd5bef5d7fefa441f6cd43a97ccadcac73513993e805d5
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                              • Size 3.6MB
                                                                                                              • SHA256 007a7ad1756eceae36cbf3de3bad53f125d0692ae5f0f4599115aaa55018856e
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                              • Size 3.5MB
                                                                                                              • SHA256 dba296bc5adba6bf2f03f0593e9bc2b605ae86c1625576f963cd68ce7f7b57e5
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                              • Size 4.1MB
                                                                                                              • SHA256 99dfd795735ebfccd85a21275727d0edd623cc1c19b276cb73b09ed9de53bfb3
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                              • Size 4.0MB
                                                                                                              • SHA256 ae7acb0522954079347376a179678372e74044ce1ce04214f50b0c7c7b513cdc
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                              • Size 3.6MB
                                                                                                              • SHA256 bb03d605b6ad2ea56b0d7627ee290270395b6fe87c3fc5cd3a4743ab78ccc1a4
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                              • Size 4.0MB
                                                                                                              • SHA256 7cb50bb64ffc814882a986c590091f0f2358f810608a3288f14ff65b5197f599
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                              • Size 4.0MB
                                                                                                              • SHA256 9c1b320c30bf7e47135f29657ef082d14f13d43c129a9ea14df59c84a1b49831
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                              • Size 3.7MB
                                                                                                              • SHA256 5463e3478580e7c5db0112d033f5735aa7dd78c1d4d56abee4e57be6a1f01630
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                              • Size 3.9MB
                                                                                                              • SHA256 98673ea762606f364f126057f13ff87f2edf350a45b8e4d17791bbcec35587e9
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                              • Size 3.9MB
                                                                                                              • SHA256 bedf0d0756acb1e8c2e0dbbcac6a89c068fd96a51c48dfb75e2d62a8fad64d86
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                              • Size 3.6MB
                                                                                                              • SHA256 b27fc435b303130bfb26050cc63b6fc77cfa058d755e45ee1d02fe94d313e5b6
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                              • Size 3.9MB
                                                                                                              • SHA256 a6c58e15a0daa8593cd5ab97435d70cde0ca9a00d8f6b3cc2e767b28ef93fa7c
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                              • Size 3.8MB
                                                                                                              • SHA256 3a1b910d79983762a86521f868d0f712fe7e79c6596bcc5d2f7248341b8dad9b
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                              • Size 3.5MB
                                                                                                              • SHA256 180d23aa7b97ff908dd09f94d6f4dd1cf0f77019d2cae1fa289ccfa3a995aabc
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                              • Size 3.8MB
                                                                                                              • SHA256 45c0c9f16e1dc708ad293707d9337af4a66042b6c293c61ba34199b2ec943a77
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                              • Size 3.8MB
                                                                                                              • SHA256 e9c0310c19951d7142b603a158386297efe33bd36c206e5de152805db6844d2f
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              Logo1_.exe
                                                                                                              • Path C:\Windows\Logo1_.exe
                                                                                                              • Size 32KB
                                                                                                              • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              _desktop.ini
                                                                                                              • Path F:\$RECYCLE.BIN\_desktop.ini
                                                                                                              • Size 9B
                                                                                                              • SHA256 66c5371c302c0168792bdad2070b6db71275df5a2ac194c19d038c7fdde2b7d6
                                                                                                              • MD5 SHA1 SHA512
                                                                                                              Submit Download

                                                                                                              memory/124-69-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/204-3346-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/264-3198-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/464-3030-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/708-2896-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/760-3121-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1084-2926-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1236-2993-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1276-2981-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1376-112-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1384-2769-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1464-45-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1524-2962-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1536-3086-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1584-2775-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1592-2824-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1636-3142-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1852-3072-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1892-82-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1944-3107-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/1948-2854-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/2004-2920-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/2144-2800-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/2148-3184-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/2256-103-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/2424-2908-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/2428-3226-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/2448-3100-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/2532-1903-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/2568-3170-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/2580-3135-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/2588-3044-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/2604-2878-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/2620-3282-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/2744-2884-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/2752-3254-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/2768-2818-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/2860-3128-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3088-3268-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3184-3051-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3264-3065-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3308-2944-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3356-3005-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3372-91-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3372-95-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3372-2695-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3376-2914-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3420-3367-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3460-2812-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3468-1796-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3588-2705-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3588-2593-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3588-331-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3588-12-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3608-2763-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3680-3247-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3720-2781-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3760-3261-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3776-3339-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3820-2938-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3876-2890-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3880-3114-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3904-3037-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4052-3191-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4120-3233-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4204-3275-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4212-3303-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4236-2932-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4316-2848-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4432-60-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4436-3163-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4464-3289-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4492-2860-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4544-2830-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4608-2842-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4740-2757-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4744-3058-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4804-2902-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4832-3205-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4868-2866-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4924-3310-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4936-2717-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4968-2872-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5024-3296-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5072-2749-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5088-2999-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5124-2738-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5180-2729-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5240-35-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5248-3156-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5252-3374-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5256-1894-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5320-3023-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5340-2700-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5344-3177-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5372-3353-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5376-471-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5412-2950-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5452-3219-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5456-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5456-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5476-2956-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5496-3017-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5520-2836-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5536-2789-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5544-3382-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5544-3376-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5628-3011-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5756-2794-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5772-3360-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5780-3093-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5808-3317-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5852-2806-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5880-3079-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5892-3240-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5924-2969-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5992-3212-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5996-3149-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/6004-2787-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/6048-2987-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/6068-3325-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/6072-3332-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/6100-2975-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download

                                                                                                              memory/6104-24-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                              Download