Overview

overview

7

Static

static

3

9ceae93ce5...58.exe

windows10-2004-x64

7

9ceae93ce5...58.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    17/10/2026, 00:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
  • Size 3.1MB
  • Sample261017-a2rnmsfs5p
  • SHA256 9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 42 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
    "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3320
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA16.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4540
      • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:3972
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aABDB.bat
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:892
          • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
            "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:1044
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAEAA.bat
              6⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3636
              • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:2712
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB07F.bat
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:3420
                  • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                    "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:1164
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB2F0.bat
                      10⤵
                      • Executes a command shell one-liner
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:1628
                      • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of WriteProcessMemory
                        PID:3852
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB4A5.bat
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:2500
                          • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                            "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • Suspicious use of WriteProcessMemory
                            PID:4336
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB5DE.bat
                              14⤵
                              • Executes a command shell one-liner
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:4200
                              • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                15⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:1696
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB820.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:3396
                                  • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                    "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • Suspicious use of WriteProcessMemory
                                    PID:2068
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA04.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:4416
                                      • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:1560
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB8B.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • Suspicious use of WriteProcessMemory
                                          PID:3912
                                          • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                            "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • Suspicious use of WriteProcessMemory
                                            PID:4896
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBDAE.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • Suspicious use of WriteProcessMemory
                                              PID:5044
                                              • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious use of WriteProcessMemory
                                                PID:3928
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF63.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:1912
                                                  • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:3768
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC3B8.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:1760
                                                      • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:364
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC84C.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:3920
                                                          • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:4392
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA02.bat
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:632
                                                              • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:4420
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCB5A.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:3304
                                                                  • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:4372
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD2E.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:1360
                                                                      • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:648
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCED4.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:1276
                                                                          • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:2920
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD00D.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:2940
                                                                              • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:4432
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD1A3.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:2756
                                                                                  • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:3696
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD349.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:3956
                                                                                      • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:2580
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD5AA.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:4712
                                                                                          • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:3312
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD702.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:4220
                                                                                              • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:4980
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD76F.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:4068
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:4720
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD83A.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:1540
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:2476
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD925.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:1292
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:4140
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD9A2.bat
                                                                                                              54⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:4620
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:4628
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA3E.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:3540
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:2864
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDAEA.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:2692
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:4296
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDB77.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          PID:756
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            PID:2400
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC13.bat
                                                                                                                              62⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              PID:3100
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:5072
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDCBF.bat
                                                                                                                                  64⤵
                                                                                                                                    PID:4412
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      PID:1664
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDD5B.bat
                                                                                                                                        66⤵
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:4504
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                                                          67⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Drops file in Windows directory
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:2444
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDDF7.bat
                                                                                                                                            68⤵
                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:1040
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                                                              69⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Drops file in Windows directory
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:2348
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDEA3.bat
                                                                                                                                                70⤵
                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                PID:3268
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                                                                  71⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                  PID:1800
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDF20.bat
                                                                                                                                                    72⤵
                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                    PID:1904
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                                                                      73⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:2240
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDF9D.bat
                                                                                                                                                        74⤵
                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                        PID:3536
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                                                                          75⤵
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:4800
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE02A.bat
                                                                                                                                                            76⤵
                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                            PID:2380
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                                                                              77⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                              PID:4964
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE0A7.bat
                                                                                                                                                                78⤵
                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:4652
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                                                                                  79⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:2304
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE124.bat
                                                                                                                                                                    80⤵
                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                    PID:5020
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                                                                                      81⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                      PID:4868
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE191.bat
                                                                                                                                                                        82⤵
                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                        PID:4232
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                                                                                          83⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                          PID:3488
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE21E.bat
                                                                                                                                                                            84⤵
                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                            PID:5028
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                                                                                              85⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                              PID:2020
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE2BA.bat
                                                                                                                                                                                86⤵
                                                                                                                                                                                  PID:1020
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                                                                                                    87⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                    PID:4812
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE3B4.bat
                                                                                                                                                                                      88⤵
                                                                                                                                                                                        PID:4696
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                                                                                                          89⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                          PID:2052
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE4EC.bat
                                                                                                                                                                                            90⤵
                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                            PID:3228
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                                                                                                              91⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              PID:2468
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE579.bat
                                                                                                                                                                                                92⤵
                                                                                                                                                                                                  PID:3776
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                                                                                                                    93⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                    PID:3288
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE635.bat
                                                                                                                                                                                                      94⤵
                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                      PID:664
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                                                                                                                        95⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                        PID:1000
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE6A2.bat
                                                                                                                                                                                                          96⤵
                                                                                                                                                                                                            PID:924
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                                                                                                                              97⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                              PID:2628
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE73E.bat
                                                                                                                                                                                                                98⤵
                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                PID:4796
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                                                                                                                                  99⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  PID:636
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE7BB.bat
                                                                                                                                                                                                                    100⤵
                                                                                                                                                                                                                      PID:760
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                                                                                                                                        101⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                        PID:1296
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE867.bat
                                                                                                                                                                                                                          102⤵
                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                          PID:5056
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                                                                                                                                            103⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                            PID:2916
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE8E4.bat
                                                                                                                                                                                                                              104⤵
                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              PID:5080
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                                                                                                                                                105⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                PID:2120
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE971.bat
                                                                                                                                                                                                                                  106⤵
                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  PID:1956
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                                                                                                                                                    107⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:4956
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEA2C.bat
                                                                                                                                                                                                                                      108⤵
                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      PID:856
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                                                                                                                                                        109⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                        PID:2808
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEAD8.bat
                                                                                                                                                                                                                                          110⤵
                                                                                                                                                                                                                                            PID:4340
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                                                                                                                                                              111⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              PID:224
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEB45.bat
                                                                                                                                                                                                                                                112⤵
                                                                                                                                                                                                                                                  PID:3792
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                                                                                                                                                                    113⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    PID:2904
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEBC2.bat
                                                                                                                                                                                                                                                      114⤵
                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                      PID:1412
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                                                                                                                                                                        115⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                        PID:3340
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEC5F.bat
                                                                                                                                                                                                                                                          116⤵
                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                          PID:4176
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                                                                                                                                                                            117⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            PID:1768
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aECEB.bat
                                                                                                                                                                                                                                                              118⤵
                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                              PID:4880
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                                                                                                                                                                                119⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                PID:1624
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED78.bat
                                                                                                                                                                                                                                                                  120⤵
                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                  PID:4864
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                                                                                                                                                                                    121⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                    PID:1100
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEE05.bat
                                                                                                                                                                                                                                                                      122⤵
                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      PID:2704
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                                                                                                                                                                                        123⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        PID:216
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEEA1.bat
                                                                                                                                                                                                                                                                          124⤵
                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                          PID:5064
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                                                                                                                                                                                            125⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                            PID:3324
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF1E.bat
                                                                                                                                                                                                                                                                              126⤵
                                                                                                                                                                                                                                                                                PID:3632
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                                                                                                                                                                                                  127⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  PID:1752
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEFAA.bat
                                                                                                                                                                                                                                                                                    128⤵
                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                    PID:1568
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                                                                                                                                                                                                      129⤵
                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                      PID:4544
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF027.bat
                                                                                                                                                                                                                                                                                        130⤵
                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                        PID:1580
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                                                                                                                                                                                                          131⤵
                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                          PID:3568
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF0B4.bat
                                                                                                                                                                                                                                                                                            132⤵
                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            PID:2848
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                                                                                                                                                                                                              133⤵
                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                              PID:5108
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF150.bat
                                                                                                                                                                                                                                                                                                134⤵
                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                PID:4224
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                                                                                                                                                                                                                  135⤵
                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                  PID:1992
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF1ED.bat
                                                                                                                                                                                                                                                                                                    136⤵
                                                                                                                                                                                                                                                                                                      PID:4616
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                                                                                                                                                                                                                        137⤵
                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                        PID:4400
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF298.bat
                                                                                                                                                                                                                                                                                                          138⤵
                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                          PID:4168
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                                                                                                                                                                                                                            139⤵
                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                            PID:1392
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF315.bat
                                                                                                                                                                                                                                                                                                              140⤵
                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                              PID:1620
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                                                                                                                                                                                                                                141⤵
                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                PID:3476
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF3A2.bat
                                                                                                                                                                                                                                                                                                                  142⤵
                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                  PID:4408
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                                                                                                                                                                                                                                    143⤵
                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                    PID:2780
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF46D.bat
                                                                                                                                                                                                                                                                                                                      144⤵
                                                                                                                                                                                                                                                                                                                        PID:4380
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                                                                                                                                                                                                                                          145⤵
                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                          PID:5116
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF509.bat
                                                                                                                                                                                                                                                                                                                            146⤵
                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                            PID:4156
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                                                                                                                                                                                                                                              147⤵
                                                                                                                                                                                                                                                                                                                                PID:1952
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF596.bat
                                                                                                                                                                                                                                                                                                                                  148⤵
                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                  PID:3876
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                                                                                                                                                                                                                                                    149⤵
                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                    PID:4136
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF623.bat
                                                                                                                                                                                                                                                                                                                                      150⤵
                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                      PID:4564
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                                                                                                                                                                                                                                                        151⤵
                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                        PID:2244
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF6CF.bat
                                                                                                                                                                                                                                                                                                                                          152⤵
                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                          PID:3940
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                                                                                                                                                                                                                                                            153⤵
                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                            PID:3864
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF79A.bat
                                                                                                                                                                                                                                                                                                                                              154⤵
                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                              PID:4832
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                                                                                                                                                                                                                                                                155⤵
                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                PID:4172
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF865.bat
                                                                                                                                                                                                                                                                                                                                                  156⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:2224
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                                                                                                                                                                                                                                                                    157⤵
                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                    PID:4448
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF901.bat
                                                                                                                                                                                                                                                                                                                                                      158⤵
                                                                                                                                                                                                                                                                                                                                                        PID:1244
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                                                                                                                                                                                                                                                                          159⤵
                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                          PID:4108
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF98E.bat
                                                                                                                                                                                                                                                                                                                                                            160⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                            PID:1224
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                                                                                                                                                                                                                                                                              161⤵
                                                                                                                                                                                                                                                                                                                                                                PID:4764
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFA1A.bat
                                                                                                                                                                                                                                                                                                                                                                  162⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:2432
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                                                                                                                                                                                                                                                                                      163⤵
                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                      PID:2736
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFAA7.bat
                                                                                                                                                                                                                                                                                                                                                                        164⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                        PID:888
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                                                                                                                                                                                                                                                                                          165⤵
                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                          PID:4760
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFB82.bat
                                                                                                                                                                                                                                                                                                                                                                            166⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                            PID:1824
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                                                                                                                                                                                                                                                                                              167⤵
                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                              PID:4248
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFC3D.bat
                                                                                                                                                                                                                                                                                                                                                                                168⤵
                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                PID:624
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
                                                                                                                                                                                                                                                                                                                                                                                  169⤵
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  PID:3328
                                                                                                                      • C:\Windows\Logo1_.exe
                                                                                                                        C:\Windows\Logo1_.exe
                                                                                                                        44⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Enumerates connected drives
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • Reads the TCP/IP host and domain name from the registry
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:1140
                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                          net stop "Kingsoft AntiVirus Service"
                                                                                                                          45⤵
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:4792
                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                            46⤵
                                                                                                                              PID:4992
                                    • C:\Windows\Logo1_.exe
                                      C:\Windows\Logo1_.exe
                                      2⤵
                                      • Executes dropped EXE
                                      • Enumerates connected drives
                                      • Drops file in Program Files directory
                                      • Drops file in Windows directory
                                      • Reads the TCP/IP host and domain name from the registry
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of WriteProcessMemory
                                      PID:3248
                                      • C:\Windows\SysWOW64\net.exe
                                        net stop "Kingsoft AntiVirus Service"
                                        3⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:4032
                                        • C:\Windows\SysWOW64\net1.exe
                                          C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                          4⤵
                                            PID:3284

                                    Network

                                          MITRE ATT&CK Enterprise v16

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          $$aAA16.bat
                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aAA16.bat
                                          • Size 722B
                                          • SHA256 52deb16f3401fe6517e9c4d70525668ed74e305a437f391185dd365adad526de
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          $$aABDB.bat
                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aABDB.bat
                                          • Size 722B
                                          • SHA256 5562b1041471012a9d35d7b65b71d8944f80c9e6f610ea4ecdfc495b764ad1bf
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          $$aAEAA.bat
                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aAEAA.bat
                                          • Size 722B
                                          • SHA256 e0b7ae8ed63fd56d14635dc1f8c8fc01e707a3509fb1736f079aba964e6906ec
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          $$aB07F.bat
                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aB07F.bat
                                          • Size 722B
                                          • SHA256 e69765a8eb20bdc108c433eb1b71e0671cb30b63e556f87f882a162ba70d8e6f
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          $$aB2F0.bat
                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aB2F0.bat
                                          • Size 722B
                                          • SHA256 94b3201f31f10c8c669a2c88b0a93441992244ce37cf4d0c538a7b15dd5f5560
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          $$aB4A5.bat
                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aB4A5.bat
                                          • Size 722B
                                          • SHA256 084b73a0d899b97ea1752aa950b954d97d4f385401a413af0947d280c586d999
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          $$aB5DE.bat
                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aB5DE.bat
                                          • Size 722B
                                          • SHA256 b4ca9f3fb7faac3f95074455f6ffa7b7806d1e684ea74e2617c02220100def0b
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          $$aB820.bat
                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aB820.bat
                                          • Size 722B
                                          • SHA256 fd111462db15f25c5b363cecd9eac56588b2e49579a120cff8b9a291a23e1222
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          $$aBA04.bat
                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aBA04.bat
                                          • Size 722B
                                          • SHA256 9a408ef930ba6bc59337c47339efdec2cb3a92f121fdebe201ae1bd760f46580
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          $$aBB8B.bat
                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aBB8B.bat
                                          • Size 722B
                                          • SHA256 16bf25ff6cb1dcd7354dc405b5d391a23b3630436d4839f30d632f97bd855dfd
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          $$aBDAE.bat
                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aBDAE.bat
                                          • Size 722B
                                          • SHA256 f07798c9783dc86c69c6bea751e88d17e908f5a97c473642a5362fe45f069317
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          $$aBF63.bat
                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aBF63.bat
                                          • Size 722B
                                          • SHA256 1a4f9b5e66bb6e84aa51060fb50bd2d5066f00412491d9552ec9a7615b7eef16
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          $$aC3B8.bat
                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aC3B8.bat
                                          • Size 722B
                                          • SHA256 fc76624c9c0dda8a80d3c6b94f735340b7dd8a2c22bd636ceb3843384336562b
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          $$aC84C.bat
                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aC84C.bat
                                          • Size 722B
                                          • SHA256 3d59ab07ce92c4a5df41815bb74ba02806a6f24726cf2cd6666f82106467c304
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          $$aCA02.bat
                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aCA02.bat
                                          • Size 722B
                                          • SHA256 3b6c56c3af6fd3dfeebc7b175c2bda14e158e72d23553d01db88d52069f329dc
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          $$aCB5A.bat
                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aCB5A.bat
                                          • Size 722B
                                          • SHA256 b02320eeee95ee0428152f064bd445f723d539149a2800d07643e95c90871702
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          $$aCD2E.bat
                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aCD2E.bat
                                          • Size 722B
                                          • SHA256 e6fdc26db0023b1d29670cd70bb3884b77eec72648a2b43dd97fb6e56f2ec996
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          $$aCED4.bat
                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aCED4.bat
                                          • Size 722B
                                          • SHA256 8319aa65730683fc2934efc8e52775cff9dea380280a18099e321a17cf7eadb7
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          $$aD00D.bat
                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aD00D.bat
                                          • Size 722B
                                          • SHA256 8c20e349e7dcc065753b44b435a9c2c2b5e0a2bc0814f99f63df35d26808924e
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          $$aD1A3.bat
                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aD1A3.bat
                                          • Size 722B
                                          • SHA256 f3010e9d872fed70d9eb8a13d1a962dc8b968548b6a7d68ae4700b712ef931e8
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          $$aD349.bat
                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aD349.bat
                                          • Size 722B
                                          • SHA256 5f59f2daf822042838028d5c20e007a3713062725b8d69a5b2ec594749feb7d0
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe.exe
                                          • Size 2.6MB
                                          • SHA256 ee9adfdf9346d85ecb40935e741f7474b6d669b2b9bbe40911c98d66a003262c
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe.exe
                                          • Size 2.7MB
                                          • SHA256 51b344a76345ac5c8ff262d852fd14c2266982c2fa883ca035af576821df0467
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe.exe
                                          • Size 2.6MB
                                          • SHA256 0630333a460cfbc6b7e2d030d74ec9651c0f4fe9dfa1b591d36b3c086eeebcaa
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe.exe
                                          • Size 2.5MB
                                          • SHA256 2d7c13f9b82a08eefb6b64a7dbb04f369fef5d043ed99494ea76398b77406555
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe.exe
                                          • Size 3.1MB
                                          • SHA256 9d9b247333e3639782f35e18d13c587e068f802b5352d35c27eadb6306f3152d
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe.exe
                                          • Size 3.0MB
                                          • SHA256 46c38ba400799437096cfe5f3d6548a504387b2e18fb1dd20fb25242ccdc1e19
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe.exe
                                          • Size 3.0MB
                                          • SHA256 92ae1a522f3be7e86031b4e375c8bbe2ec4e4f3e0eb9a521974409011eb59b9e
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe.exe
                                          • Size 2.9MB
                                          • SHA256 22851ae5ae7201cff187b3f39c8b49acc70ccf1659ddd16972dfc343d60e3902
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe.exe
                                          • Size 2.6MB
                                          • SHA256 cd17e3aa13a4ca000c97d5c7ccd1c42a2e6ea66b2e4dffc252a02cfad59cd6cf
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe.exe
                                          • Size 2.5MB
                                          • SHA256 3fb47bd3ad128f54a0865ea0c8a09ec94e4da3afdbde0879aa0c06d32dc535a4
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe.exe
                                          • Size 3.0MB
                                          • SHA256 2fa8cbdfb9dcae9cb0096d6a5e0a92309fc1ba975b649233da4291b5b49c7503
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe.exe
                                          • Size 2.9MB
                                          • SHA256 afbe5574d83355a5f0531ae30614b92429901f17e74d224c883f4f006ec0d4c0
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe.exe
                                          • Size 2.5MB
                                          • SHA256 4cb0f10e621ccd3e6d40ccbcb91e14e60b6b2ef7293c9447f3653cbe99544126
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe.exe
                                          • Size 2.9MB
                                          • SHA256 a2d23321aa6b85e80f393b50df1ab683edd0ea394cd17381c7f040411cb634f2
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe.exe
                                          • Size 2.8MB
                                          • SHA256 47d4822282e2ee761231ae47ed1ff029e848563df80ef12b8e77df87bdee7f13
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe.exe
                                          • Size 2.5MB
                                          • SHA256 bfacc0ebe775cf8a0fa4cde6c5e55aa26d6c17671c3303042d3b083e8df71ff1
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe.exe
                                          • Size 2.8MB
                                          • SHA256 bc61c17ba9573db374a4cd25b3bd00de1c741ebc70c82a4e814535c4187213c2
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe.exe
                                          • Size 2.7MB
                                          • SHA256 68c6edbe4bb98882d4d7ddd8cea9166a3c269cc9491ffbfc014fd25874f7685d
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe.exe
                                          • Size 2.8MB
                                          • SHA256 cd8e646026de5530a1489433f89e0952878eb80ac799f9f9b50c8e7f6cecfcef
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe.exe
                                          • Size 2.7MB
                                          • SHA256 a07a3c6949ea710fbacdf22d0622ca6daf28ff186240cb72e0cd76ab9f8b5710
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          Logo1_.exe
                                          • Path C:\Windows\Logo1_.exe
                                          • Size 32KB
                                          • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          _desktop.ini
                                          • Path F:\$RECYCLE.BIN\_desktop.ini
                                          • Size 10B
                                          • SHA256 63e88b8d19d69b081af987c4000305aa56469cdb3211e8600d1b196ed0479546
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          memory/216-1574-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/224-1544-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/364-1305-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/636-1514-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/648-1337-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/1000-1504-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/1044-29-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/1100-1569-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/1140-1372-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/1140-1423-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/1164-54-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/1296-1519-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/1392-1620-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/1560-100-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/1624-1564-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/1664-1432-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/1696-82-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/1752-1584-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/1768-1559-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/1800-1447-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/1952-1644-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/1992-1608-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/2020-1479-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/2052-1489-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/2068-90-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/2120-1529-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/2240-1449-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/2244-1656-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/2304-1464-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/2348-1442-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/2400-1420-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/2444-1437-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/2468-1494-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/2476-1395-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/2580-1374-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/2628-1509-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/2712-39-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/2736-1692-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/2780-1632-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/2808-1539-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/2864-1410-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/2904-1549-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/2916-1524-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/2920-1345-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/3248-1350-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/3248-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/3248-1366-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/3248-105-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/3288-1499-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/3312-1380-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/3320-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/3320-9-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/3324-1579-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/3340-1554-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/3476-1626-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/3488-1474-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/3568-1596-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/3696-1362-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/3768-1061-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/3852-62-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/3864-1662-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/3928-117-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/3972-21-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/4108-1680-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/4136-1650-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/4140-1400-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/4172-1668-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/4248-1705-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/4248-1700-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/4296-1415-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/4336-70-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/4372-1329-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/4392-1313-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/4400-1614-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/4420-1321-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/4432-1354-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/4448-1674-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/4544-1590-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/4628-1405-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/4720-1390-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/4760-1698-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/4764-1686-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/4800-1454-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/4812-1484-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/4868-1469-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/4896-109-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/4956-1534-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/4964-1459-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/4980-1385-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/5072-1427-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/5108-1602-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/5116-1638-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download