Overview

overview

7

Static

static

3

86e8deb840...31.exe

windows10-2004-x64

7

86e8deb840...31.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    14/10/2026, 11:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
  • Size 3.1MB
  • Sample261014-nxfbpsct2k
  • SHA256 86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 42 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 1 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
    "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1104
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE76D.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2124
      • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
        "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:1880
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE980.bat
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3468
          • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
            "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:4456
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEBF1.bat
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:4376
              • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4256
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED78.bat
                  8⤵
                  • Executes a command shell one-liner
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:2520
                  • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                    "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:100
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF6C.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4804
                      • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                        "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:2280
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF17F.bat
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:4284
                          • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                            "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • Suspicious use of WriteProcessMemory
                            PID:1972
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF364.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:3772
                              • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:452
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF548.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:4044
                                  • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                    "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • Suspicious use of WriteProcessMemory
                                    PID:2712
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF78A.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:3268
                                      • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                        "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • Suspicious use of WriteProcessMemory
                                        PID:4212
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF8D2.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • Suspicious use of WriteProcessMemory
                                          PID:436
                                          • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                            "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:1436
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFA88.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • Suspicious use of WriteProcessMemory
                                              PID:1136
                                              • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious use of WriteProcessMemory
                                                PID:948
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFD28.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:4392
                                                  • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:3924
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFFB8.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:3416
                                                      • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:4244
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4C9.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:4660
                                                          • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:1844
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6AD.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:2696
                                                              • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:5096
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a98B.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:2268
                                                                  • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:2728
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB22.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:4252
                                                                      • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:4756
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD06.bat
                                                                          36⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:4868
                                                                          • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:1976
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF58.bat
                                                                              38⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:4908
                                                                              • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:2052
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1207.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:644
                                                                                  • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:1220
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a134F.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:64
                                                                                      • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:2176
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a13CC.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:1124
                                                                                          • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:4100
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a143A.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:752
                                                                                              • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:3832
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a14A7.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:548
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:3880
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1553.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:2448
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:3140
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a15C0.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:4500
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:4944
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a164D.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:4732
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:608
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a16CA.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:2296
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:2676
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1757.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:2820
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:3168
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a17C4.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:4520
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:740
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1851.bat
                                                                                                                              62⤵
                                                                                                                                PID:2288
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  PID:552
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a18DD.bat
                                                                                                                                    64⤵
                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                    PID:4492
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:2456
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a195A.bat
                                                                                                                                        66⤵
                                                                                                                                          PID:2672
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                                            67⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:4188
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a19C8.bat
                                                                                                                                              68⤵
                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:4352
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                                                69⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:3100
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1A64.bat
                                                                                                                                                  70⤵
                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                  PID:3112
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                                                    71⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                    PID:3360
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1B1F.bat
                                                                                                                                                      72⤵
                                                                                                                                                        PID:4580
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                                                          73⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:1704
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1BCB.bat
                                                                                                                                                            74⤵
                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                            PID:5020
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                                                              75⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                              PID:2332
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1C39.bat
                                                                                                                                                                76⤵
                                                                                                                                                                  PID:1696
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                                                                    77⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:3508
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1CD5.bat
                                                                                                                                                                      78⤵
                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                      PID:884
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                                                                        79⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        PID:3000
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1D62.bat
                                                                                                                                                                          80⤵
                                                                                                                                                                            PID:992
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                                                                              81⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:4296
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1DDF.bat
                                                                                                                                                                                82⤵
                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                PID:3252
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                                                                                  83⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  PID:4136
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1E6B.bat
                                                                                                                                                                                    84⤵
                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                    PID:4144
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                                                                                      85⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:516
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1F17.bat
                                                                                                                                                                                        86⤵
                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                        PID:3256
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                                                                                          87⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                          PID:4268
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1F94.bat
                                                                                                                                                                                            88⤵
                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            PID:4068
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                                                                                              89⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                              PID:4532
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2021.bat
                                                                                                                                                                                                90⤵
                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                PID:4260
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                                                                                                  91⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  PID:3744
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a20CD.bat
                                                                                                                                                                                                    92⤵
                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:3276
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                                                                                                      93⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      PID:4776
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2169.bat
                                                                                                                                                                                                        94⤵
                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                        PID:2368
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                                                                                                          95⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          PID:1888
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a21E6.bat
                                                                                                                                                                                                            96⤵
                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                            PID:1872
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                                                                                                              97⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                              PID:212
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2272.bat
                                                                                                                                                                                                                98⤵
                                                                                                                                                                                                                  PID:4472
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                                                                                                                    99⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                    PID:4640
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a22EF.bat
                                                                                                                                                                                                                      100⤵
                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                      PID:3760
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                                                                                                                        101⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                        PID:2568
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a236C.bat
                                                                                                                                                                                                                          102⤵
                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                          PID:2300
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                                                                                                                            103⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                            PID:4476
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2438.bat
                                                                                                                                                                                                                              104⤵
                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                              PID:5116
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                                                                                                                                105⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                PID:640
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a24E3.bat
                                                                                                                                                                                                                                  106⤵
                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                  PID:1168
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                                                                                                                                    107⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:656
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a25AF.bat
                                                                                                                                                                                                                                      108⤵
                                                                                                                                                                                                                                        PID:2644
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                                                                                                                                          109⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          PID:2364
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a262C.bat
                                                                                                                                                                                                                                            110⤵
                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                            PID:2808
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                                                                                                                                              111⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                              PID:4792
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a26D7.bat
                                                                                                                                                                                                                                                112⤵
                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                PID:1552
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                                                                                                                                                  113⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  PID:4288
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2745.bat
                                                                                                                                                                                                                                                    114⤵
                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                    PID:3104
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                                                                                                                                                      115⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                      PID:2192
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a27D1.bat
                                                                                                                                                                                                                                                        116⤵
                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:1480
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                                                                                                                                                          117⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          PID:2132
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a286E.bat
                                                                                                                                                                                                                                                            118⤵
                                                                                                                                                                                                                                                              PID:1272
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                                                                                                                                                                119⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                PID:4468
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2997.bat
                                                                                                                                                                                                                                                                  120⤵
                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                  PID:4108
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                                                                                                                                                                    121⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    PID:2736
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2A91.bat
                                                                                                                                                                                                                                                                      122⤵
                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                      PID:4708
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                                                                                                                                                                        123⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                        PID:4460
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2B4C.bat
                                                                                                                                                                                                                                                                          124⤵
                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                          PID:4488
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                                                                                                                                                                            125⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            PID:3616
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2BD9.bat
                                                                                                                                                                                                                                                                              126⤵
                                                                                                                                                                                                                                                                                PID:1460
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                                                                                                                                                                                  127⤵
                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                  PID:540
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2C94.bat
                                                                                                                                                                                                                                                                                    128⤵
                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                    PID:924
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                                                                                                                                                                                      129⤵
                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      PID:2624
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2D11.bat
                                                                                                                                                                                                                                                                                        130⤵
                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                        PID:836
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                                                                                                                                                                                          131⤵
                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                          PID:2148
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2D9E.bat
                                                                                                                                                                                                                                                                                            132⤵
                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                            PID:1196
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                                                                                                                                                                                              133⤵
                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                              PID:3284
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E2A.bat
                                                                                                                                                                                                                                                                                                134⤵
                                                                                                                                                                                                                                                                                                  PID:3340
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                                                                                                                                                                                                    135⤵
                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                    PID:4948
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2EB7.bat
                                                                                                                                                                                                                                                                                                      136⤵
                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                      PID:2160
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                                                                                                                                                                                                        137⤵
                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                        PID:4796
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2F63.bat
                                                                                                                                                                                                                                                                                                          138⤵
                                                                                                                                                                                                                                                                                                            PID:4176
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                                                                                                                                                                                                              139⤵
                                                                                                                                                                                                                                                                                                                PID:1652
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2FE0.bat
                                                                                                                                                                                                                                                                                                                  140⤵
                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                  PID:4988
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                                                                                                                                                                                                                    141⤵
                                                                                                                                                                                                                                                                                                                      PID:2388
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a305D.bat
                                                                                                                                                                                                                                                                                                                        142⤵
                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                        PID:5044
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                                                                                                                                                                                                                          143⤵
                                                                                                                                                                                                                                                                                                                            PID:1000
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a30DA.bat
                                                                                                                                                                                                                                                                                                                              144⤵
                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                              PID:1636
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                                                                                                                                                                                                                                145⤵
                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                PID:2980
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3186.bat
                                                                                                                                                                                                                                                                                                                                  146⤵
                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                  PID:2812
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                                                                                                                                                                                                                                    147⤵
                                                                                                                                                                                                                                                                                                                                      PID:4156
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3203.bat
                                                                                                                                                                                                                                                                                                                                        148⤵
                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                        PID:4072
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                                                                                                                                                                                                                                          149⤵
                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                          PID:3016
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3280.bat
                                                                                                                                                                                                                                                                                                                                            150⤵
                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                            PID:2260
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                                                                                                                                                                                                                                              151⤵
                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                              PID:2964
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a334B.bat
                                                                                                                                                                                                                                                                                                                                                152⤵
                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                PID:1084
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                                                                                                                                                                                                                                                  153⤵
                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                  PID:2968
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3406.bat
                                                                                                                                                                                                                                                                                                                                                    154⤵
                                                                                                                                                                                                                                                                                                                                                      PID:2720
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                                                                                                                                                                                                                                                        155⤵
                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                        PID:768
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3500.bat
                                                                                                                                                                                                                                                                                                                                                          156⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                          PID:776
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                                                                                                                                                                                                                                                            157⤵
                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                            PID:3500
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a35AC.bat
                                                                                                                                                                                                                                                                                                                                                              158⤵
                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                              PID:1968
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                                                                                                                                                                                                                                                                159⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:872
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3697.bat
                                                                                                                                                                                                                                                                                                                                                                    160⤵
                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                    PID:3324
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                                                                                                                                                                                                                                                                      161⤵
                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                      PID:3672
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3752.bat
                                                                                                                                                                                                                                                                                                                                                                        162⤵
                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                        PID:732
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                                                                                                                                                                                                                                                                          163⤵
                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                          PID:2384
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a37FE.bat
                                                                                                                                                                                                                                                                                                                                                                            164⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                            PID:4192
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                                                                                                                                                                                                                                                                              165⤵
                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                              PID:344
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a387B.bat
                                                                                                                                                                                                                                                                                                                                                                                166⤵
                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                PID:1756
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                                                                                                                                                                                                                                                                                  167⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  PID:2244
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3965.bat
                                                                                                                                                                                                                                                                                                                                                                                    168⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                    PID:1056
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                                                                                                                                                                                                                                                                                      169⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                      PID:4816
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3A21.bat
                                                                                                                                                                                                                                                                                                                                                                                        170⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                        PID:116
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe"
                                                                                                                                                                                                                                                                                                                                                                                          171⤵
                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                          PID:1736
                                                                                                              • C:\Windows\Logo1_.exe
                                                                                                                C:\Windows\Logo1_.exe
                                                                                                                38⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Enumerates connected drives
                                                                                                                • Drops file in Windows directory
                                                                                                                • Reads the TCP/IP host and domain name from the registry
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:4936
                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                  net stop "Kingsoft AntiVirus Service"
                                                                                                                  39⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:4584
                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                    40⤵
                                                                                                                      PID:1792
                                        • C:\Windows\Logo1_.exe
                                          C:\Windows\Logo1_.exe
                                          2⤵
                                          • Executes dropped EXE
                                          • Enumerates connected drives
                                          • Drops file in Program Files directory
                                          • Reads the TCP/IP host and domain name from the registry
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of WriteProcessMemory
                                          PID:4292
                                          • C:\Windows\SysWOW64\net.exe
                                            net stop "Kingsoft AntiVirus Service"
                                            3⤵
                                            • Suspicious use of WriteProcessMemory
                                            PID:4800
                                            • C:\Windows\SysWOW64\net1.exe
                                              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                              4⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:64
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 796
                                            3⤵
                                            • Program crash
                                            PID:3228
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4292 -ip 4292
                                        1⤵
                                          PID:980

                                        Network

                                              MITRE ATT&CK Enterprise v16

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads

                                              $$a4C9.bat
                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a4C9.bat
                                              • Size 721B
                                              • SHA256 caaa359f979ded43551211a024688c689aa8ac397356b1a45de3bb163f6bbf1e
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              $$a6AD.bat
                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a6AD.bat
                                              • Size 721B
                                              • SHA256 065838fd65bc222c04b75786cd3273705c6cfc5ace38651a6ed4896459a5039e
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              $$a98B.bat
                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a98B.bat
                                              • Size 721B
                                              • SHA256 b5e7987b2a566af07e696d77bfa42a780c0eaa574e60140ec7151b4d52777263
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              $$aB22.bat
                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aB22.bat
                                              • Size 721B
                                              • SHA256 3149d796da1c13bf84c152c7f9b13b005e4c4c9e70f20ffac2393ba55dd2637c
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              $$aD06.bat
                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aD06.bat
                                              • Size 721B
                                              • SHA256 f9718141e24ec7dd757fd2d40d4659b47a34701c9a21aa0bf7bb856921060fc7
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              $$aE76D.bat
                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aE76D.bat
                                              • Size 722B
                                              • SHA256 909b9bc75d37be5bcb9ab6e06bc0d7e999692e502e50fc459d488b4ff9197b5e
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              $$aE980.bat
                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aE980.bat
                                              • Size 722B
                                              • SHA256 dafaeffd40250a36cb390654c982a0583863f562e05ddc31f6eaed70977fecfa
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              $$aEBF1.bat
                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aEBF1.bat
                                              • Size 722B
                                              • SHA256 dfc29edbc69224abb57021cfc4271d9ef1cc98a04324efe502451c4e9c825680
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              $$aED78.bat
                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aED78.bat
                                              • Size 722B
                                              • SHA256 ca2aeda29adc277df1912b4e86d130001e0feadef945465a6224e66efd1e6c86
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              $$aEF6C.bat
                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aEF6C.bat
                                              • Size 722B
                                              • SHA256 841c44a5ff13f283bb1082eacc0a05b1af3cf1888171941967fca665fd910b8b
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              $$aF17F.bat
                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aF17F.bat
                                              • Size 722B
                                              • SHA256 1326523dca3f7192773819e893904837e4f029e4b53913889eaa40429afed530
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              $$aF364.bat
                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aF364.bat
                                              • Size 722B
                                              • SHA256 d7f83a253981defeea23d654f4db5df724c80398b365be193ff8484f9c65031e
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              $$aF548.bat
                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aF548.bat
                                              • Size 722B
                                              • SHA256 47181b186075812c711d123649d1dd7878c862c748a28122ea03d532a2c9abe3
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              $$aF58.bat
                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aF58.bat
                                              • Size 721B
                                              • SHA256 332690a6fb72461d938a2639ca927760d0c3dd66f22e56eb12fdd2b34d1e48d6
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              $$aF78A.bat
                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aF78A.bat
                                              • Size 722B
                                              • SHA256 0ba7373538875a9e141e570a7b3347762009faad8af5c7b5b7a4e08f0611a509
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              $$aF8D2.bat
                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aF8D2.bat
                                              • Size 722B
                                              • SHA256 4ad133ffbf60e05c3eaa769874e648f4c0d3742af3118eb54b3f678be1cb92df
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              $$aFA88.bat
                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aFA88.bat
                                              • Size 722B
                                              • SHA256 60c68c956cabceaf2da6d0327bc8e6f022127411e0a882fded8796266adacd97
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              $$aFD28.bat
                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aFD28.bat
                                              • Size 722B
                                              • SHA256 f6003e93c296e4c9924af0e3fcfada0eba3af788de683ebe2eaf7a62eeb17320
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              $$aFFB8.bat
                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aFFB8.bat
                                              • Size 722B
                                              • SHA256 68b02ca5b0dd19114f8fbf30fd79f70b9bf698daa3567a73701ae27e3d305ecf
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                              • Path C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe
                                              • Size 2.8MB
                                              • SHA256 18a778ba3e0615bb7c08ce1f28ea63cf945b5b9f00186c22be28979b6dcd6e9c
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe.exe
                                              • Path C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe.exe
                                              • Size 2.7MB
                                              • SHA256 d8c324b6645e26adcd0a5b466fe4543899c28becb739b30a577fac75b5d7367e
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe.exe
                                              • Path C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe.exe
                                              • Size 2.7MB
                                              • SHA256 fc2e3f9fba1a36637562b87e9fdb6e99834c28a46d23c213c780710967dd1a0d
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe.exe
                                              • Path C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe.exe
                                              • Size 2.6MB
                                              • SHA256 1a8af199d2a01b4976287f4ea8b1f88498b95cef0c8d9eac6f32edaf991027fd
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe.exe
                                              • Path C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe.exe
                                              • Size 2.6MB
                                              • SHA256 4f3dca7091e3290b8540efa4fa1b7cb30acb4a50482916775552ca9d3deb7cfe
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe.exe
                                              • Path C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe.exe
                                              • Size 2.6MB
                                              • SHA256 d0ad678a1e9e13c5dd490a3a7fa864861390884aa1ffce74b3383055af45b52b
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe.exe
                                              • Path C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe.exe
                                              • Size 2.5MB
                                              • SHA256 0ca2ad748a435aa592a399137a306b2107cc4214166cdf2c930e7046aea911b7
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe.exe
                                              • Path C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe.exe
                                              • Size 2.5MB
                                              • SHA256 1ef28e0cb942efc0fcf2cc608a07dd9f703f6458d3f312c917a49158e18ab044
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe.exe
                                              • Path C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe.exe
                                              • Size 3.1MB
                                              • SHA256 9748c50cfd29dd07e067fc34620e3d7ca1838029a8eb8910aa6ba2bfc77b1696
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe.exe
                                              • Path C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe.exe
                                              • Size 3.0MB
                                              • SHA256 e33e1bf9883bb5ed00dab3ba9fa31d55fca5f9f80424d6358134c95c281adbcc
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe.exe
                                              • Path C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe.exe
                                              • Size 2.9MB
                                              • SHA256 ca2a29edb48ebcd1369f36f154503853411f2417505e84d3b5b991aac35b6f57
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe.exe
                                              • Path C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe.exe
                                              • Size 2.9MB
                                              • SHA256 81a6c65922f17de3b12d2d477f1cc11dd2b46045e25d928465117edb531dc4af
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe.exe
                                              • Path C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe.exe
                                              • Size 2.8MB
                                              • SHA256 c412027b70a9506846fd37c51ca5122de6977c05dfd94cdd4c0e4e08da2ee2b2
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe.exe
                                              • Path C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe.exe
                                              • Size 2.7MB
                                              • SHA256 6b76200bf12973c0be92df1701aeb72fcbcb9d462eb244ffbf3b7aee5d3c00e3
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe.exe
                                              • Path C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe.exe
                                              • Size 3.1MB
                                              • SHA256 3374047218ccd99d77eca02cd22496eb8d595b4d851322815bffd0079877a637
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe.exe
                                              • Path C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe.exe
                                              • Size 3.0MB
                                              • SHA256 6229474f5406c91d30425992f398ea4b295bb4c98f8d18c068fb0e8ca76fc197
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe.exe
                                              • Path C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe.exe
                                              • Size 3.0MB
                                              • SHA256 120290ec143914c66d44464f9e234a1a8a491dc2f60f5df321a7991dc061ebd0
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe.exe
                                              • Path C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe.exe
                                              • Size 2.9MB
                                              • SHA256 f5eb84323818c28f8c8b3f51e8262ec9448bb5da517645cc12c68da2b5df381e
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe.exe
                                              • Path C:\Users\Admin\AppData\Local\Temp\86e8deb84053f16e64d218aeccf998d3f1fe7ab5a85d8f32a8ada56638cb8731.exe.exe
                                              • Size 2.8MB
                                              • SHA256 918372626cb4b5e287dc40b7a82f7121746ce41f2b6eb7c6f89e06084780226a
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              Logo1_.exe
                                              • Path C:\Windows\Logo1_.exe
                                              • Size 32KB
                                              • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              _desktop.ini
                                              • Path F:\$RECYCLE.BIN\_desktop.ini
                                              • Size 10B
                                              • SHA256 3cc655fb77d8ee9d3bd8d6ef6851f203306a7e76fc6c88010f361a7375fe8836
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              memory/100-49-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/212-2147-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/344-2336-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/452-83-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/516-2117-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/540-2222-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/552-2062-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/608-2040-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/640-2167-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/656-2172-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/740-2056-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/768-2305-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/872-2317-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/948-118-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/1000-2269-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/1104-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/1104-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/1220-2005-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/1436-110-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/1652-2257-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/1704-2087-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/1844-1816-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/1880-22-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/1880-18-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/1888-2142-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/1972-71-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/1976-1990-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/2052-2000-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/2132-2197-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/2148-2233-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/2176-2010-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/2192-2192-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/2244-2342-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/2280-63-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/2332-2092-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/2364-2177-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/2384-2330-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/2388-2263-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/2456-2067-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/2568-2157-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/2624-2227-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/2676-2046-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/2712-91-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/2728-1914-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/2736-2207-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/2964-2293-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/2968-2299-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/2980-2275-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/3000-2102-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/3016-2287-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/3100-2077-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/3140-2030-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/3168-2051-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/3284-2239-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/3360-2082-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/3500-2311-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/3508-2097-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/3616-2217-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/3672-2324-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/3744-2132-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/3832-2020-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/3880-2025-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/3924-263-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/4100-2015-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/4136-2112-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/4156-2281-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/4188-2072-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/4212-99-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/4244-1678-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/4256-40-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/4268-2122-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/4288-2187-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/4292-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/4292-1976-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/4292-106-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/4296-2107-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/4456-30-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/4460-2212-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/4468-2202-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/4476-2162-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/4532-2127-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/4640-2152-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/4756-1922-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/4776-2137-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/4792-2182-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/4796-2251-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/4816-2344-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/4816-2349-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/4936-1989-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/4936-2042-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/4944-2035-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/4948-2245-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download

                                              memory/5096-1906-0x0000000000400000-0x0000000000445000-memory.dmp
                                              Download