Overview

overview

8

Static

static

3

a12ccf2685...ad.exe

windows10-2004-x64

8

a12ccf2685...ad.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/10/2026, 07:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
  • Size 4.7MB
  • Sample261002-jadgdawdke
  • SHA256 a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 44 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 2 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
    "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3308
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a142A.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2364
      • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
        "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5480
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1851.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4240
          • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
            "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:5248
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1FC3.bat
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:5456
              • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:2812
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a26B8.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3348
                  • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                    "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:3372
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a33F7.bat
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:1096
                      • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                        "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:928
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a36C6.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:4808
                          • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                            "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:5420
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3C82.bat
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:5008
                              • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:1516
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a406A.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:3624
                                  • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                    "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:4640
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4329.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:2052
                                      • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                        "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:6132
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a453D.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:3980
                                          • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                            "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • Suspicious use of WriteProcessMemory
                                            PID:1564
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a479E.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • Suspicious use of WriteProcessMemory
                                              PID:4144
                                              • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious use of WriteProcessMemory
                                                PID:5148
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4A2E.bat
                                                  24⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:4136
                                                  • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:3404
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5644.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:4952
                                                      • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:5212
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5903.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:4760
                                                          • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:2784
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5BA3.bat
                                                              30⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:4680
                                                              • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:860
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5E72.bat
                                                                  32⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:1816
                                                                  • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:2032
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a618F.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:688
                                                                      • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:2944
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a63C1.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:4732
                                                                          • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:5416
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6642.bat
                                                                              38⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:2424
                                                                              • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:3356
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6894.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:2992
                                                                                  • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:5920
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a698E.bat
                                                                                      42⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:2732
                                                                                      • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:4676
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6A88.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:4284
                                                                                          • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:3952
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6B91.bat
                                                                                              46⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:5876
                                                                                              • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:6020
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6C8B.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:5364
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:5688
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6DA4.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:708
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:1056
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6EAE.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:4328
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:3332
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6FC7.bat
                                                                                                              54⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:1412
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:6068
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a70A2.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:4216
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:4628
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a719C.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:1064
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:2000
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7286.bat
                                                                                                                          60⤵
                                                                                                                            PID:2928
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                              61⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:252
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7371.bat
                                                                                                                                62⤵
                                                                                                                                • Executes a command shell one-liner
                                                                                                                                PID:3656
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  PID:4656
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a746B.bat
                                                                                                                                    64⤵
                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                    PID:4232
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      PID:3924
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7574.bat
                                                                                                                                        66⤵
                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                        PID:4560
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                          67⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:2360
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a765F.bat
                                                                                                                                            68⤵
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:2136
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                              69⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:2400
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7759.bat
                                                                                                                                                70⤵
                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                PID:4172
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                  71⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:6060
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7824.bat
                                                                                                                                                    72⤵
                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:1144
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                      73⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:4528
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a795C.bat
                                                                                                                                                        74⤵
                                                                                                                                                          PID:1204
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                            75⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            PID:3268
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A66.bat
                                                                                                                                                              76⤵
                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                              PID:5344
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                77⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                PID:1248
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7B70.bat
                                                                                                                                                                  78⤵
                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                  PID:1628
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                    79⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:6052
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7C5A.bat
                                                                                                                                                                      80⤵
                                                                                                                                                                        PID:2380
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                          81⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                          PID:3236
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7D64.bat
                                                                                                                                                                            82⤵
                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                            PID:4372
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                              83⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              PID:5424
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E7D.bat
                                                                                                                                                                                84⤵
                                                                                                                                                                                  PID:2396
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                    85⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    PID:4728
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7F67.bat
                                                                                                                                                                                      86⤵
                                                                                                                                                                                        PID:4452
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                          87⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                          PID:5476
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8061.bat
                                                                                                                                                                                            88⤵
                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                            PID:2352
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                              89⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:5412
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a814C.bat
                                                                                                                                                                                                90⤵
                                                                                                                                                                                                  PID:4992
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                    91⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                    PID:1528
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8255.bat
                                                                                                                                                                                                      92⤵
                                                                                                                                                                                                        PID:5240
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                          93⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          PID:5368
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8330.bat
                                                                                                                                                                                                            94⤵
                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                            PID:2212
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                              95⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              PID:620
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a843A.bat
                                                                                                                                                                                                                96⤵
                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                PID:4664
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                  97⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  PID:2864
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8553.bat
                                                                                                                                                                                                                    98⤵
                                                                                                                                                                                                                      PID:1372
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                        99⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                        PID:5664
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a865D.bat
                                                                                                                                                                                                                          100⤵
                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                          PID:5812
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                            101⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            PID:4972
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8776.bat
                                                                                                                                                                                                                              102⤵
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              PID:4688
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                103⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                PID:5492
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8870.bat
                                                                                                                                                                                                                                  104⤵
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  PID:1052
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                    105⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    PID:5820
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a894B.bat
                                                                                                                                                                                                                                      106⤵
                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                      PID:4764
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                        107⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                        PID:5276
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A35.bat
                                                                                                                                                                                                                                          108⤵
                                                                                                                                                                                                                                            PID:876
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                              109⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              PID:5124
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B10.bat
                                                                                                                                                                                                                                                110⤵
                                                                                                                                                                                                                                                  PID:5140
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                    111⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    PID:4700
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C29.bat
                                                                                                                                                                                                                                                      112⤵
                                                                                                                                                                                                                                                        PID:5776
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                          113⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          PID:2568
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D04.bat
                                                                                                                                                                                                                                                            114⤵
                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                            PID:1936
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                              115⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              PID:1876
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8DCF.bat
                                                                                                                                                                                                                                                                116⤵
                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                PID:1432
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                  117⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                  PID:1584
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8ED8.bat
                                                                                                                                                                                                                                                                    118⤵
                                                                                                                                                                                                                                                                      PID:1060
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                        119⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                        PID:4784
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9001.bat
                                                                                                                                                                                                                                                                          120⤵
                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                          PID:5724
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                            121⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                            PID:552
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a90EC.bat
                                                                                                                                                                                                                                                                              122⤵
                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                              PID:4752
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                123⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                PID:5976
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a91D6.bat
                                                                                                                                                                                                                                                                                  124⤵
                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                  PID:1172
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                    125⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                    PID:5636
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a92B1.bat
                                                                                                                                                                                                                                                                                      126⤵
                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                      PID:4480
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                        127⤵
                                                                                                                                                                                                                                                                                          PID:2240
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a938C.bat
                                                                                                                                                                                                                                                                                            128⤵
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            PID:3944
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                              129⤵
                                                                                                                                                                                                                                                                                                PID:3012
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9466.bat
                                                                                                                                                                                                                                                                                                  130⤵
                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                  PID:1332
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                    131⤵
                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                    PID:3020
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9570.bat
                                                                                                                                                                                                                                                                                                      132⤵
                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                      PID:5228
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                        133⤵
                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                        PID:2356
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a966A.bat
                                                                                                                                                                                                                                                                                                          134⤵
                                                                                                                                                                                                                                                                                                            PID:5372
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                              135⤵
                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                              PID:6004
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9745.bat
                                                                                                                                                                                                                                                                                                                136⤵
                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                PID:2956
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                  137⤵
                                                                                                                                                                                                                                                                                                                    PID:4632
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a984E.bat
                                                                                                                                                                                                                                                                                                                      138⤵
                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                      PID:4160
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                        139⤵
                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                        PID:1988
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9919.bat
                                                                                                                                                                                                                                                                                                                          140⤵
                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                          PID:3212
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                            141⤵
                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                            PID:3060
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A04.bat
                                                                                                                                                                                                                                                                                                                              142⤵
                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                              PID:3860
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                143⤵
                                                                                                                                                                                                                                                                                                                                  PID:4504
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9ADF.bat
                                                                                                                                                                                                                                                                                                                                    144⤵
                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                    PID:4512
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                      145⤵
                                                                                                                                                                                                                                                                                                                                        PID:1388
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9BC9.bat
                                                                                                                                                                                                                                                                                                                                          146⤵
                                                                                                                                                                                                                                                                                                                                            PID:4584
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                              147⤵
                                                                                                                                                                                                                                                                                                                                                PID:4488
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9CB3.bat
                                                                                                                                                                                                                                                                                                                                                  148⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:2516
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                    149⤵
                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                    PID:1356
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9DAD.bat
                                                                                                                                                                                                                                                                                                                                                      150⤵
                                                                                                                                                                                                                                                                                                                                                        PID:264
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                          151⤵
                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                          PID:5984
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9EA7.bat
                                                                                                                                                                                                                                                                                                                                                            152⤵
                                                                                                                                                                                                                                                                                                                                                              PID:4248
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                153⤵
                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                PID:2836
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9FB1.bat
                                                                                                                                                                                                                                                                                                                                                                  154⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:5644
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                      155⤵
                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                      PID:3540
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA0BB.bat
                                                                                                                                                                                                                                                                                                                                                                        156⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:4836
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                            157⤵
                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                            PID:4860
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA176.bat
                                                                                                                                                                                                                                                                                                                                                                              158⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                              PID:6040
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                                159⤵
                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                PID:5468
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA260.bat
                                                                                                                                                                                                                                                                                                                                                                                  160⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                  PID:5548
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                                    161⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                    PID:2456
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA2FD.bat
                                                                                                                                                                                                                                                                                                                                                                                      162⤵
                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                      PID:2376
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                                        163⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                        PID:4876
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA3D7.bat
                                                                                                                                                                                                                                                                                                                                                                                          164⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                          PID:4196
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                                            165⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                            PID:6016
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA4C2.bat
                                                                                                                                                                                                                                                                                                                                                                                              166⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:1852
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  167⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4412
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA5DB.bat
                                                                                                                                                                                                                                                                                                                                                                                                      168⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:3652
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          169⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                          PID:3452
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA6E5.bat
                                                                                                                                                                                                                                                                                                                                                                                                            170⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2600
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              171⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1256
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA8AA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5880
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4668
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA9A4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                      174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1192
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1676
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA7F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                          176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4420
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1448
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB4A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3008
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4844
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC24.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                      180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2304
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2740
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aACFF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                            182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1836
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5296
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aADDA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                    184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5132
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3216
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE95.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                        186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5660
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4956
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF70.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                              188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3444
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB03B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB116.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB1F1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB2AC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB368.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB443.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB52D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB608.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB6E2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB7CD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB8A8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB9C1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBABB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB96.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC70.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD2C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBDF7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBEC2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF9D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC078.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC162.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC22D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC2D9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC3B4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC46F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC54A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC634.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC6FF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC7CB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC8B5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC9CE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCAA9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCB93.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC4F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD0A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCDD5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCECF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCFBA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD095.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD18F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2536
                                                                                                                                                                  • C:\Windows\Logo1_.exe
                                                                                                                                                                    C:\Windows\Logo1_.exe
                                                                                                                                                                    16⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                    • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                    PID:5860
                                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                      net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                      17⤵
                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                      PID:1088
                                                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                        18⤵
                                                                                                                                                                          PID:5820
                                                                                                                                        • C:\Windows\Logo1_.exe
                                                                                                                                          C:\Windows\Logo1_.exe
                                                                                                                                          2⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Enumerates connected drives
                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                          • Drops file in Windows directory
                                                                                                                                          • Reads the TCP/IP host and domain name from the registry
                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                          PID:5168
                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                            net stop "Kingsoft AntiVirus Service"
                                                                                                                                            3⤵
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                            PID:5076
                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                              4⤵
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:4188
                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 5168 -s 1000
                                                                                                                                            3⤵
                                                                                                                                            • Program crash
                                                                                                                                            PID:1448
                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 5168 -s 1084
                                                                                                                                            3⤵
                                                                                                                                            • Program crash
                                                                                                                                            PID:6068
                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5168 -ip 5168
                                                                                                                                        1⤵
                                                                                                                                          PID:2528
                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 5168 -ip 5168
                                                                                                                                          1⤵
                                                                                                                                            PID:5936

                                                                                                                                          Network

                                                                                                                                                MITRE ATT&CK Enterprise v16

                                                                                                                                                Replay Monitor

                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                Downloads

                                                                                                                                                $$a142A.bat
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a142A.bat
                                                                                                                                                • Size 722B
                                                                                                                                                • SHA256 b8c7eff4b4c29e894a33e146df18a1a7216c8a310eaedc76b6384927579f6c28
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                $$a1851.bat
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a1851.bat
                                                                                                                                                • Size 722B
                                                                                                                                                • SHA256 0d96dc945a8736b9bcb70ef15036ecd342c6edd46781465e09bfe8363534e80e
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                $$a1FC3.bat
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a1FC3.bat
                                                                                                                                                • Size 722B
                                                                                                                                                • SHA256 7a90883e539c5977a7ab19bbc4199eb25815a46c70c1a5282d97eb4f0f85c80c
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                $$a26B8.bat
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a26B8.bat
                                                                                                                                                • Size 722B
                                                                                                                                                • SHA256 b3bb9c399748964f31027ec633d7b323201a098699c02abaf98b8c243e785e7f
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                $$a33F7.bat
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a33F7.bat
                                                                                                                                                • Size 722B
                                                                                                                                                • SHA256 3d99b348e73e1e7b7063fcc8546302976367680cf5a97ef4ce488b8fea5311a8
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                $$a36C6.bat
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a36C6.bat
                                                                                                                                                • Size 722B
                                                                                                                                                • SHA256 1b95f44680ba8ebab5f29bbb812e4f0982e1f9a0ee5b259ce35a93b8cef5062e
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                $$a3C82.bat
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a3C82.bat
                                                                                                                                                • Size 722B
                                                                                                                                                • SHA256 21a364c3ff9e19069d37afc76a925cd4582b468ea3e585e6bb43e136ad25218a
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                $$a406A.bat
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a406A.bat
                                                                                                                                                • Size 722B
                                                                                                                                                • SHA256 120762017b73a39385a7c922c19bae06765277853c7aa362e7b2c1f58ab14d51
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                $$a4329.bat
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a4329.bat
                                                                                                                                                • Size 722B
                                                                                                                                                • SHA256 735338ccf10dbe3572ab069fac69161f8f70025ba5f272dd76506bbfe63f31fc
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                $$a453D.bat
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a453D.bat
                                                                                                                                                • Size 722B
                                                                                                                                                • SHA256 b3f40c0b8739c346afaea02ec19fef7da46b9a1a6cfbf904e5fe8cec8201600c
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                $$a479E.bat
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a479E.bat
                                                                                                                                                • Size 722B
                                                                                                                                                • SHA256 2ca064013afe3767c2c422ed107f60694efbf3bc5a742ad1d82d484ddb03940f
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                $$a4A2E.bat
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a4A2E.bat
                                                                                                                                                • Size 722B
                                                                                                                                                • SHA256 0132bc59b71c655439addfa75d9a6a8170907718a1eca3160d8884aa98b396e7
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                $$a5644.bat
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a5644.bat
                                                                                                                                                • Size 722B
                                                                                                                                                • SHA256 77b18d06e949e45dc3d9d1da9f7e8571edfe920de61629fec1c1b9f1fa144045
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                $$a5903.bat
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a5903.bat
                                                                                                                                                • Size 722B
                                                                                                                                                • SHA256 25381374a8d661ffebaeebb9f1066315a786eef946e6153148c7ab2554ab8831
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                $$a5BA3.bat
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a5BA3.bat
                                                                                                                                                • Size 722B
                                                                                                                                                • SHA256 b38a8c396348ffdb22ab7aa91cdbaa54a6bb168409e6c9d09423bc9b7aee0753
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                $$a5E72.bat
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a5E72.bat
                                                                                                                                                • Size 722B
                                                                                                                                                • SHA256 cc129f6d8f8fafc44125ac49449459249f6d001c9b0b29b2b3a0558c6f90cde4
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                $$a618F.bat
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a618F.bat
                                                                                                                                                • Size 722B
                                                                                                                                                • SHA256 239f7e5fde2a2a5ec886688db8704d6ce216b3c4bc3f4e1b2261c31f65e07795
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                $$a63C1.bat
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a63C1.bat
                                                                                                                                                • Size 722B
                                                                                                                                                • SHA256 735c53a5524c5fcedb77ad211dede2e1253292dbf0b1de9ed0a90705f8cb3fc0
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe.exe
                                                                                                                                                • Size 4.5MB
                                                                                                                                                • SHA256 984a5e0ca7c4c003c360aa2bedf9978d554162c507fabc50f148c7cc74a2568f
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe.exe
                                                                                                                                                • Size 4.5MB
                                                                                                                                                • SHA256 c5c7bede6e709463f61d5d6c8b5c9eaa15caf8d8c2bf72aa0bc808801c8b7d0e
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe.exe
                                                                                                                                                • Size 4.4MB
                                                                                                                                                • SHA256 ea164f13e3ee86bd08a024c86e5d3f7c7bd28ef870cc66f49315dfd78686842a
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe.exe
                                                                                                                                                • Size 4.3MB
                                                                                                                                                • SHA256 c760a908005d7de70539e8445c8bd6c461b34f3ffbeeafd5fe79d4fa0e843327
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe.exe
                                                                                                                                                • Size 4.7MB
                                                                                                                                                • SHA256 36da94b2583161f32c3303cc5ed7782bb7077b91ca4cb60ad3a31d386ba31c4d
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe.exe
                                                                                                                                                • Size 4.6MB
                                                                                                                                                • SHA256 3d4233b10cf397f1e4a362f55a1c587cbe579cc261a58f38e4476adfe8135dac
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe.exe
                                                                                                                                                • Size 4.3MB
                                                                                                                                                • SHA256 2929d799f4b1d5923447da669dadae0e648da316baf64278dd99eb6460f68dea
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe.exe
                                                                                                                                                • Size 4.6MB
                                                                                                                                                • SHA256 a0c60ee6ef2145b460dc8c17bf951b0cfd0fc88c29b8f9a0e5bece4a37c321cb
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe.exe
                                                                                                                                                • Size 4.6MB
                                                                                                                                                • SHA256 e8a9b1d2691842a5baa914703a94015a15efb82a38b2f452da356c44d735e1aa
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe.exe
                                                                                                                                                • Size 4.2MB
                                                                                                                                                • SHA256 9b82a0f80bae9203dcb466192e463e259904106c65578410de53cb176b53ea10
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe.exe
                                                                                                                                                • Size 4.5MB
                                                                                                                                                • SHA256 15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe.exe
                                                                                                                                                • Size 4.2MB
                                                                                                                                                • SHA256 b588f418928c093ce9965307f0e495d784e62db162d4aba89b1ee3ba3163f901
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe.exe
                                                                                                                                                • Size 4.4MB
                                                                                                                                                • SHA256 578a69c56b8c151cd14735562b89776689cb8556be18604494433cfe44a82ccc
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe.exe
                                                                                                                                                • Size 4.4MB
                                                                                                                                                • SHA256 f736789652bfc017d6e87b07d2c7706c692f5dfb8b18810a4c3a10182390463c
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe.exe
                                                                                                                                                • Size 4.3MB
                                                                                                                                                • SHA256 440bbe978f25dbe3fd40e4ea3148f8302dee1ebf09edf355559cf76fec3c3adf
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe.exe
                                                                                                                                                • Size 4.2MB
                                                                                                                                                • SHA256 7bb4f2c2bf387140389e7de8c2287e7990b605a40075a4d39a08e426b3f38451
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe.exe
                                                                                                                                                • Size 4.2MB
                                                                                                                                                • SHA256 e01d6a680e8175e84b6c4749d68a29564364ba6285a2d9c3b94c25ba93ec41f0
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\a12ccf26858b87f668562729178ee9406763e67d4ac6eba4b49cc0db231dbfad.exe.exe
                                                                                                                                                • Size 4.1MB
                                                                                                                                                • SHA256 b75d83c80a759cee08357551141ceefc5c8cbfd591381dbc8ec0eac88e928142
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Dll.dll
                                                                                                                                                • Path C:\Windows\Dll.dll
                                                                                                                                                • Size 68KB
                                                                                                                                                • SHA256 58902ae17338af4211e7e21eddb09671507b48740fa7056b9b7f7ab307da0168
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Logo1_.exe
                                                                                                                                                • Path C:\Windows\Logo1_.exe
                                                                                                                                                • Size 32KB
                                                                                                                                                • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                _desktop.ini
                                                                                                                                                • Path F:\$RECYCLE.BIN\_desktop.ini
                                                                                                                                                • Size 9B
                                                                                                                                                • SHA256 66c5371c302c0168792bdad2070b6db71275df5a2ac194c19d038c7fdde2b7d6
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                memory/252-2292-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/476-2886-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/552-2473-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/620-2394-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/860-2191-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/928-1830-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/948-2802-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/1056-2262-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/1240-2872-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/1244-2837-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/1248-2340-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/1256-2647-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/1288-2979-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/1288-2985-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/1356-2570-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/1388-2556-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/1448-2668-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/1516-2112-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/1528-2382-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/1536-2795-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/1560-2809-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/1564-2143-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/1576-2851-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/1584-2460-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/1676-2661-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/1684-2879-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/1848-2893-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/1876-2454-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/1988-2535-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/2000-2286-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/2032-2200-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/2188-2710-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/2240-2493-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/2268-2844-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/2356-2514-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/2360-2310-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/2400-2316-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/2456-2612-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/2568-2448-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/2624-2830-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/2700-2928-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/2740-2682-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/2784-2182-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/2812-57-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/2836-2584-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/2840-2731-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/2864-2400-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/2944-2209-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3012-2500-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3020-2507-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3060-2542-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3148-2858-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3216-2696-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3236-2352-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3244-2823-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3268-2334-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3308-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3308-13-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3332-2268-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3340-2816-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3356-2221-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3356-2226-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3372-1820-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3388-2767-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3404-2163-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3452-2640-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3460-2774-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3540-2591-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3768-2865-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3924-2304-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3952-2244-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4316-2781-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4332-2900-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4348-2738-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4380-2956-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4408-2963-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4412-2633-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4468-2921-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4488-2563-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4504-2549-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4528-2328-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4628-2280-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4632-2528-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4640-2123-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4656-2298-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4668-2654-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4676-2238-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4700-2442-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4728-2364-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4784-2467-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4844-2675-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4860-2598-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4876-2619-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4956-2703-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4972-2412-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5028-2935-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5056-2907-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5124-2436-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5148-2154-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5168-2100-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5168-2089-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5168-1825-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5168-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5212-2172-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5232-2977-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5248-42-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5276-2430-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5296-2689-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5332-2760-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5368-2388-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5412-2376-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5416-2218-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5420-2094-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5424-2358-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5428-2949-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5468-2605-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5476-2370-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5480-24-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5492-2418-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5568-2788-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5636-2486-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5664-2406-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5688-2256-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5748-2745-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5752-2914-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5820-2424-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5860-2177-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5860-2462-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5860-2220-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5900-2724-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5912-2717-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5920-2232-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5976-2479-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5984-2577-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/6004-2521-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/6016-2626-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/6020-2250-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/6028-2970-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/6052-2346-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/6060-2322-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/6068-2274-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/6088-2942-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/6100-2752-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/6132-2132-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download