Overview

overview

7

Static

static

3

44d75f6252...88.exe

windows10-2004-x64

7

44d75f6252...88.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/10/2026, 09:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
  • Size 4.2MB
  • Sample261011-k2jcdafa69
  • SHA256 44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 42 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
    "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3504
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB8B7.bat
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4952
      • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
        "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2352
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB67.bat
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1936
          • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
            "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:5492
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE45.bat
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4452
              • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:3464
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC1EF.bat
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:4460
                  • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                    "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of WriteProcessMemory
                    PID:4328
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC5C7.bat
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:4360
                      • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                        "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of WriteProcessMemory
                        PID:3088
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC951.bat
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:5688
                          • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                            "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • Suspicious use of WriteProcessMemory
                            PID:1944
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC5E.bat
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:1088
                              • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:5940
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD538.bat
                                  16⤵
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:1816
                                  • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                    "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:5784
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD73C.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:2004
                                      • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                        "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:5404
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDB04.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:2480
                                          • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                            "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of WriteProcessMemory
                                            PID:5044
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE31.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • Suspicious use of WriteProcessMemory
                                              PID:5296
                                              • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of WriteProcessMemory
                                                PID:2896
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE0D1.bat
                                                  24⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:1956
                                                  • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:1036
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE323.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:4984
                                                      • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:4740
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE565.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:2904
                                                          • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:5112
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE7D6.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:5564
                                                              • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:2436
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEA66.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:5896
                                                                  • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:624
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aECC7.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:4796
                                                                      • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:1052
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF0FD.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:5184
                                                                          • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:2964
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF34F.bat
                                                                              38⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:6000
                                                                              • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:3956
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF61E.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:2864
                                                                                  • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:5744
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF989.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:3052
                                                                                      • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:5556
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFC29.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:2956
                                                                                          • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:3524
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFD13.bat
                                                                                              46⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:3140
                                                                                              • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:1920
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFDDE.bat
                                                                                                  48⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:1068
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:1076
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFEB9.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:4076
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:4604
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFF94.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:4092
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:3460
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:5768
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:2184
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a178.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:2968
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:672
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a253.bat
                                                                                                                      58⤵
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:4304
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        PID:2752
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a33D.bat
                                                                                                                          60⤵
                                                                                                                            PID:4640
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                              61⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:4016
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a418.bat
                                                                                                                                62⤵
                                                                                                                                • Executes a command shell one-liner
                                                                                                                                PID:3224
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  PID:4548
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a512.bat
                                                                                                                                    64⤵
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:4904
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      PID:260
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5ED.bat
                                                                                                                                        66⤵
                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                        PID:5884
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                          67⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Drops file in Windows directory
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:4848
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6D7.bat
                                                                                                                                            68⤵
                                                                                                                                              PID:3572
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                69⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:4912
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7D1.bat
                                                                                                                                                  70⤵
                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:4800
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                    71⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                    PID:3976
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8AC.bat
                                                                                                                                                      72⤵
                                                                                                                                                        PID:1908
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                          73⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:1780
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A6.bat
                                                                                                                                                            74⤵
                                                                                                                                                              PID:4600
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                75⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                PID:2472
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA81.bat
                                                                                                                                                                  76⤵
                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:1020
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                    77⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                    PID:2312
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB2D.bat
                                                                                                                                                                      78⤵
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      PID:4340
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                        79⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                        PID:4420
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC07.bat
                                                                                                                                                                          80⤵
                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                          PID:1716
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                            81⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:6068
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD2.bat
                                                                                                                                                                              82⤵
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:3660
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                83⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                PID:936
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDBD.bat
                                                                                                                                                                                  84⤵
                                                                                                                                                                                    PID:3420
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                      85⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:3152
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEA7.bat
                                                                                                                                                                                        86⤵
                                                                                                                                                                                          PID:6060
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                            87⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            PID:4300
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF53.bat
                                                                                                                                                                                              88⤵
                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                              PID:2516
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                89⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                PID:4404
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a102E.bat
                                                                                                                                                                                                  90⤵
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  PID:2580
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                    91⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    PID:2116
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1147.bat
                                                                                                                                                                                                      92⤵
                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                      PID:2508
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                        93⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                        PID:1468
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1222.bat
                                                                                                                                                                                                          94⤵
                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                          PID:2036
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                            95⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                            PID:3748
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a12DD.bat
                                                                                                                                                                                                              96⤵
                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                              PID:5828
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                97⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                PID:4708
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a13A8.bat
                                                                                                                                                                                                                  98⤵
                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  PID:4840
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                    99⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    PID:4228
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1483.bat
                                                                                                                                                                                                                      100⤵
                                                                                                                                                                                                                        PID:4532
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                          101⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                          PID:5276
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a155E.bat
                                                                                                                                                                                                                            102⤵
                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:1432
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                              103⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              PID:3912
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1619.bat
                                                                                                                                                                                                                                104⤵
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                PID:3588
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                  105⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                  PID:5020
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a16E5.bat
                                                                                                                                                                                                                                    106⤵
                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                    PID:2408
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                      107⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      PID:4956
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a17B0.bat
                                                                                                                                                                                                                                        108⤵
                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                        PID:5800
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                          109⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          PID:1476
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a187B.bat
                                                                                                                                                                                                                                            110⤵
                                                                                                                                                                                                                                              PID:6136
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                111⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                PID:3700
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1927.bat
                                                                                                                                                                                                                                                  112⤵
                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                  PID:2644
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                    113⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                    PID:5288
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a19C3.bat
                                                                                                                                                                                                                                                      114⤵
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:4788
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                        115⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        PID:2460
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1A8E.bat
                                                                                                                                                                                                                                                          116⤵
                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                          PID:3372
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                            117⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                            PID:2668
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1B3A.bat
                                                                                                                                                                                                                                                              118⤵
                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                              PID:5996
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                119⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                PID:2084
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1BE6.bat
                                                                                                                                                                                                                                                                  120⤵
                                                                                                                                                                                                                                                                    PID:5208
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                      121⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                      PID:2928
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1CA1.bat
                                                                                                                                                                                                                                                                        122⤵
                                                                                                                                                                                                                                                                          PID:2984
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                            123⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                            PID:4964
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1D7C.bat
                                                                                                                                                                                                                                                                              124⤵
                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                              PID:1532
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                                125⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                PID:4752
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1E66.bat
                                                                                                                                                                                                                                                                                  126⤵
                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                  PID:3520
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                                    127⤵
                                                                                                                                                                                                                                                                                      PID:2616
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1F51.bat
                                                                                                                                                                                                                                                                                        128⤵
                                                                                                                                                                                                                                                                                          PID:5408
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                                            129⤵
                                                                                                                                                                                                                                                                                              PID:4808
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1FFD.bat
                                                                                                                                                                                                                                                                                                130⤵
                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                PID:1544
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                                                  131⤵
                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                  PID:4388
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a20C8.bat
                                                                                                                                                                                                                                                                                                    132⤵
                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                    PID:4772
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                                                      133⤵
                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                      PID:1412
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a21B2.bat
                                                                                                                                                                                                                                                                                                        134⤵
                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                        PID:4696
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                                                          135⤵
                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                          PID:480
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a226E.bat
                                                                                                                                                                                                                                                                                                            136⤵
                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                            PID:1172
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                                                              137⤵
                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                              PID:5796
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2329.bat
                                                                                                                                                                                                                                                                                                                138⤵
                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                PID:2208
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                                                                  139⤵
                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                  PID:4612
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a23F4.bat
                                                                                                                                                                                                                                                                                                                    140⤵
                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                    PID:2748
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                                                                      141⤵
                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                      PID:5820
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a24CF.bat
                                                                                                                                                                                                                                                                                                                        142⤵
                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                        PID:4120
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                                                                          143⤵
                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                          PID:3340
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a259A.bat
                                                                                                                                                                                                                                                                                                                            144⤵
                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                            PID:4004
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                                                                              145⤵
                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                              PID:3512
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2636.bat
                                                                                                                                                                                                                                                                                                                                146⤵
                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                PID:1384
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                                                                                  147⤵
                                                                                                                                                                                                                                                                                                                                    PID:4248
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2711.bat
                                                                                                                                                                                                                                                                                                                                      148⤵
                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                      PID:1688
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                                                                                        149⤵
                                                                                                                                                                                                                                                                                                                                          PID:1084
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a27BD.bat
                                                                                                                                                                                                                                                                                                                                            150⤵
                                                                                                                                                                                                                                                                                                                                              PID:4844
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                                                                                                151⤵
                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                PID:1440
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2879.bat
                                                                                                                                                                                                                                                                                                                                                  152⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:2660
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                                                                                                    153⤵
                                                                                                                                                                                                                                                                                                                                                      PID:5892
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2934.bat
                                                                                                                                                                                                                                                                                                                                                        154⤵
                                                                                                                                                                                                                                                                                                                                                          PID:5064
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                                                                                                            155⤵
                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                            PID:4312
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a29D0.bat
                                                                                                                                                                                                                                                                                                                                                              156⤵
                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                              PID:1996
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                                                                                                                157⤵
                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                PID:5464
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2A8C.bat
                                                                                                                                                                                                                                                                                                                                                                  158⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:1548
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                                                                                                                      159⤵
                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                      PID:4536
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2B38.bat
                                                                                                                                                                                                                                                                                                                                                                        160⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:3676
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                                                                                                                            161⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:4664
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2BF3.bat
                                                                                                                                                                                                                                                                                                                                                                                162⤵
                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                PID:4448
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                                                                                                                                  163⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                  PID:2976
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2CCE.bat
                                                                                                                                                                                                                                                                                                                                                                                    164⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                    PID:200
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                                                                                                                                      165⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                      PID:1528
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2D99.bat
                                                                                                                                                                                                                                                                                                                                                                                        166⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:1584
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                                                                                                                                            167⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                            PID:3600
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E55.bat
                                                                                                                                                                                                                                                                                                                                                                                              168⤵
                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                              PID:5816
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                                                                                                                                                169⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                PID:4140
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2F00.bat
                                                                                                                                                                                                                                                                                                                                                                                                  170⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4352
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      171⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                      PID:108
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2F9D.bat
                                                                                                                                                                                                                                                                                                                                                                                                        172⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                        PID:5972
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          173⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:3560
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3039.bat
                                                                                                                                                                                                                                                                                                                                                                                                              174⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2424
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2504
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a30E5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                  176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4820
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4528
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3191.bat
                                                                                                                                                                                                                                                                                                                                                                                                                        178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5092
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1560
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a323D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                            180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4044
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2176
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a32F8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                  182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2724
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5244
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a33A4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                      184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5600
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6140
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3431.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                            186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1572
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1836
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a34BD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5544
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1288
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3579.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                      190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3220
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1924
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3625.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                            192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5036
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a36D0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a378C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3819.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a38C4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3990.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3A3B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3AD8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3B74.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3C10.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3CCC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3D68.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3E04.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3E91.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3F3D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3FD9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4085.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4111.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a41BD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a425A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a42F6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a43C1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3844
                                                                                                                                                                                      • C:\Windows\Logo1_.exe
                                                                                                                                                                                        C:\Windows\Logo1_.exe
                                                                                                                                                                                        42⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                        • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                        PID:5188
                                                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                          net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                          43⤵
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                          PID:2924
                                                                                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                            44⤵
                                                                                                                                                                                              PID:2324
                                                                                                        • C:\Windows\Logo1_.exe
                                                                                                          C:\Windows\Logo1_.exe
                                                                                                          2⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • Enumerates connected drives
                                                                                                          • Drops file in Program Files directory
                                                                                                          • Reads the TCP/IP host and domain name from the registry
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:4948
                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                            net stop "Kingsoft AntiVirus Service"
                                                                                                            3⤵
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:1912
                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                              4⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              PID:4044

                                                                                                      Network

                                                                                                            MITRE ATT&CK Enterprise v16

                                                                                                            Replay Monitor

                                                                                                            Loading Replay Monitor...

                                                                                                            Downloads

                                                                                                            $$aB8B7.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aB8B7.bat
                                                                                                            • Size 722B
                                                                                                            • SHA256 554e1ee8a59c940de0916da50a0037604f8107d5d3e783f0ebb9f3a6fabc5129
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$aBB67.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aBB67.bat
                                                                                                            • Size 722B
                                                                                                            • SHA256 4c02d01f433c5b8da2984b374b576bf6f562b322cb259ca030185277d1cfed7d
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$aBE45.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aBE45.bat
                                                                                                            • Size 722B
                                                                                                            • SHA256 1d74898e29489cdd7b95fe7756c8a3247061ee5bdf25ae86a42103029ba1930f
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$aC1EF.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aC1EF.bat
                                                                                                            • Size 722B
                                                                                                            • SHA256 9fb3b16efd3534f004d5f6e5f3b378e4e28a834f73c1160bd413225de01ff3cb
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$aC5C7.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aC5C7.bat
                                                                                                            • Size 722B
                                                                                                            • SHA256 d78e7f810c0c064fa0d960e96850c55b4715ec9493b96593bb5be1f258d25f43
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$aC951.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aC951.bat
                                                                                                            • Size 722B
                                                                                                            • SHA256 0f0dd1de5e9ba14cfd781b292ec86526b266a3450764804536ebd367cff7aa58
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$aCC5E.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aCC5E.bat
                                                                                                            • Size 722B
                                                                                                            • SHA256 b7c5fb42531417aff5bc139ca73af3b9274761ac38634d34a7cc6afe14de49de
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$aD538.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aD538.bat
                                                                                                            • Size 722B
                                                                                                            • SHA256 8bde3bc7d08c892371f343025722362f5d15abb80e42aa15e3ece4c0d8e50eb4
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$aD73C.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aD73C.bat
                                                                                                            • Size 722B
                                                                                                            • SHA256 fa30d727832cbfcfa0d1f5b987f9b6b380a8609c6cbf1a6e93e57da0a1f10e0b
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$aDB04.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aDB04.bat
                                                                                                            • Size 722B
                                                                                                            • SHA256 059f224f696334037637d08aef4c59ef318ea4fd849e5fe95efdc2be3caeb8fe
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$aDE31.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aDE31.bat
                                                                                                            • Size 722B
                                                                                                            • SHA256 4ee357a4834c9a5c158b551e20870e471683465a84605f29d366e4d969c8288e
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$aE0D1.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aE0D1.bat
                                                                                                            • Size 722B
                                                                                                            • SHA256 8925e067f6b4a5717fa7ac45ed815a632f7494d8c31674d4d4c1575f9839975d
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$aE323.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aE323.bat
                                                                                                            • Size 722B
                                                                                                            • SHA256 52b4c9678b2373ecb7edf481cf9b7a613c54e05515de3a16cae30418802dd095
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$aE565.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aE565.bat
                                                                                                            • Size 722B
                                                                                                            • SHA256 4f21861150dbb08a81491265b42e266d8982dcf4ded73964a3bea58fb1c1f07a
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$aE7D6.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aE7D6.bat
                                                                                                            • Size 722B
                                                                                                            • SHA256 f747d5244b2d4c097a82cfab75b7ac94d524e7e19bf5896d170672dddfe44d0f
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$aEA66.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aEA66.bat
                                                                                                            • Size 722B
                                                                                                            • SHA256 28289eadb0979eb84e7a0e65cfab9fba36ab1a38cf1bf2521fa21c30fbed5a40
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$aECC7.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aECC7.bat
                                                                                                            • Size 722B
                                                                                                            • SHA256 a7fbd0e72f3ce9d869e181c8c3a6f046ff384144be8aab87ee28db479bbdc055
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$aF0FD.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aF0FD.bat
                                                                                                            • Size 722B
                                                                                                            • SHA256 b0cc1a83840e365b9160d426ab2f81cfcbc27db28308472e00f112041173b78c
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$aF34F.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aF34F.bat
                                                                                                            • Size 722B
                                                                                                            • SHA256 d3539e0f99e321912eb754f56546bcb0aad8009205aa601039522efa095d1963
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$aF61E.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aF61E.bat
                                                                                                            • Size 722B
                                                                                                            • SHA256 046a1ae108e28c45ce13e2928eb3b4df0f41a268cd27289501ab7bdd50ca3e64
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe.exe
                                                                                                            • Size 4.0MB
                                                                                                            • SHA256 5741691290ec5efbe0ee693be5235c08149496daedcbf70e4da1b18c9394cef5
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe.exe
                                                                                                            • Size 4.1MB
                                                                                                            • SHA256 6684456e0a6c16ffa531f79fc7b3492d24c203bc10b14a460d3051684242cc6c
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe.exe
                                                                                                            • Size 4.0MB
                                                                                                            • SHA256 0989cfbf6a726449565a64dd4d54c50a83fbba8d1fc96f86ddcf71a89a375948
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe.exe
                                                                                                            • Size 4.1MB
                                                                                                            • SHA256 faeaa2aa2a56f5946a805209a3143723a7faf9d30a5fa4bdec212a79181bd218
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe.exe
                                                                                                            • Size 4.1MB
                                                                                                            • SHA256 0cc3351016028fd10a84f1cd0ca7c261a1113f2e9b7d1f9f32a5b40647164047
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe.exe
                                                                                                            • Size 3.8MB
                                                                                                            • SHA256 773d8fdb658b4ab8f6b57f86234a5ca7f7e8f36b8fa87df7c0a8cffeb5374665
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe.exe
                                                                                                            • Size 3.8MB
                                                                                                            • SHA256 73458feb3489db50c59863fd4b2b46d0e51fc560339f1da3a096f9d8d51614fe
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe.exe
                                                                                                            • Size 3.9MB
                                                                                                            • SHA256 6e3f992e74f918acbd815d7d4a6268052ff032f281d686fc79f3e7542cf8b61a
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe.exe
                                                                                                            • Size 3.8MB
                                                                                                            • SHA256 e2a0dc73dc54802d3914231fd4f68474d7ab4718dd5923d9c1e380088bcfa69b
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe.exe
                                                                                                            • Size 3.7MB
                                                                                                            • SHA256 796b0b67946ddfc64dcc2c3ad0a00e4662dd6d4e6dc4e84ffaae278e459b559c
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe.exe
                                                                                                            • Size 3.7MB
                                                                                                            • SHA256 ba05ef1ffdee1916d6382eb65bbccf8eb361c788d4cda8ed945e2e65337097b1
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe.exe
                                                                                                            • Size 3.7MB
                                                                                                            • SHA256 31e4109ee2ac373ddcf20741e8434a27ce929bab580acf8619ec3ecade074180
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe.exe
                                                                                                            • Size 4.0MB
                                                                                                            • SHA256 10d8997ed62fc25579594404dffd57fdbaa4e571b6789e40c31750fa34620d43
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe.exe
                                                                                                            • Size 3.6MB
                                                                                                            • SHA256 16590a57f08201f887fd14b8ff4cdee7336a4d26cb90406cd5d2077d76da1534
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe.exe
                                                                                                            • Size 3.6MB
                                                                                                            • SHA256 cda468d12d80ceee14da838faed0a2655c6b89cb58e20f19e742774fda682a14
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe.exe
                                                                                                            • Size 3.9MB
                                                                                                            • SHA256 890d3fed05292beaf9a6c24a597b3f4dfe8114ac1eaa5a9129d9adfcdcc5704a
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe.exe
                                                                                                            • Size 3.6MB
                                                                                                            • SHA256 b5d73e2b8c21d9b5d4ebfc589a223e53c4606ac61ae654a55c28946a32f1382f
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe.exe
                                                                                                            • Size 3.5MB
                                                                                                            • SHA256 1a95b3ba35cef498df94813fcb9f3bda0544594c8f11b708ac9774a9ce1e4b45
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe.exe
                                                                                                            • Size 3.9MB
                                                                                                            • SHA256 a9ad4ffe1253ca9671c5f6b769ae36e5382ed9c8c2fba40ab232e1f264fbc117
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\44d75f6252fcfef3e3acf3c07aeed930ee321abb27d531765c7670ba60d2d888.exe.exe
                                                                                                            • Size 3.5MB
                                                                                                            • SHA256 d1196db1b983bb7637cbdd19a271e802cc72e134f53be17ba199aa2c7e8f4468
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            Logo1_.exe
                                                                                                            • Path C:\Windows\Logo1_.exe
                                                                                                            • Size 32KB
                                                                                                            • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            _desktop.ini
                                                                                                            • Path F:\$RECYCLE.BIN\_desktop.ini
                                                                                                            • Size 10B
                                                                                                            • SHA256 6f32c14d8a0712d435829019df23525a5b62bb2ca9b24874a6316ec374b3d04c
                                                                                                            • MD5 SHA1 SHA512
                                                                                                            Submit Download

                                                                                                            memory/108-2875-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/260-2533-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/480-2749-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/624-2417-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/672-2509-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/936-2587-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1036-2381-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1052-2426-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1076-2484-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1084-2798-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1288-2938-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1396-2952-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1412-2742-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1440-2805-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1468-2617-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1476-2665-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1528-2854-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1552-3050-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1560-2903-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1668-3008-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1780-2557-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1836-2931-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1920-2478-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1924-2945-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1944-85-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1968-2959-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2084-2695-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2116-2611-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2176-2910-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2184-2503-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2312-2569-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2332-3057-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2352-20-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2352-25-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2436-2408-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2460-2683-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2472-2563-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2504-2889-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2616-2720-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2668-2689-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2752-2515-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2776-2994-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2840-3085-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2896-2372-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2928-2701-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2944-3015-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2964-2435-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2976-2847-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3088-74-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3152-2593-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3340-2777-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3460-2497-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3464-52-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3504-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3504-13-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3512-2784-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3524-2472-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3560-2882-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3600-2861-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3640-3043-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3700-2671-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3748-2623-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3912-2647-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3956-2444-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3976-2551-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3984-3078-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4016-2521-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4040-3029-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4140-2868-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4228-2635-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4248-2791-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4300-2599-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4312-2819-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4328-65-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4388-2734-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4404-2605-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4420-2575-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4528-2896-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4536-2833-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4548-2527-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4604-2490-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4612-2763-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4664-2840-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4708-2629-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4740-2390-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4752-2713-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4808-2727-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4848-2539-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4888-3093-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4888-3087-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4912-2545-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4948-1853-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4948-2446-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4948-2367-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4948-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4956-2659-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4964-2707-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4988-3064-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5020-2653-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5044-2362-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5112-2399-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5188-2516-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5192-3022-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5244-2917-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5276-2641-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5288-2677-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5304-2980-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5404-2101-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5464-2826-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5492-36-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5556-2466-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5672-3071-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5684-2987-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5744-2459-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5784-1858-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5796-2756-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5820-2770-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5892-2812-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5932-3001-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5940-1710-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5952-3036-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/6008-2973-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/6024-2966-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/6068-2581-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/6140-2924-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download