be0234f8efdde6a2dfe06308b04e824125a23ae2ec0c9e42630088660ca61ca0

Analysis

max time kernel
173s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 20:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03cc81994173a2270d4a42ec620fc289.exe
Size

13KB
MD5

03cc81994173a2270d4a42ec620fc289
SHA1

72be100d2b5589adbb54c1691735ff0ee7e5a25d
SHA256

be0234f8efdde6a2dfe06308b04e824125a23ae2ec0c9e42630088660ca61ca0
SHA512

d515d5aa8d4165a7bfb58f1171c0c273228cb54fcc743d519c4ed9e88cc4af27e1179b833ca38802bb67a63663c3c1863f593bf13c287a301116a9214ee36bc3
SSDEEP

384:hytZyFKxG4fffffffrxy1ROXIrXIXaY15XZk5p:hynyFiG4fffffffrxy1UXIrYB15JkX

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3704	ayPATPAT1023.exe
1144	ayPATPAT1023.exe
3892	ayPATPAT1023.exe
1844	ayPATPAT1023.exe
1316	ayPATPAT1023.exe
1996	ayPATPAT1023.exe
1608	Conhost.exe
4092	ayPATPAT1023.exe
3164	ayPATPAT1023.exe
2704	attrib.exe
3728	ayPATPAT1023.exe
3552	ayPATPAT1023.exe
4720	ayPATPAT1023.exe
2796	ayPATPAT1023.exe
3928	ayPATPAT1023.exe
1040	Conhost.exe
4428	ayPATPAT1023.exe
4544	ayPATPAT1023.exe
864	ayPATPAT1023.exe
4968	ayPATPAT1023.exe
3892	ayPATPAT1023.exe
4328	ayPATPAT1023.exe
3424	ayPATPAT1023.exe
4832	ayPATPAT1023.exe
3728	ayPATPAT1023.exe
4592	Conhost.exe
4120	ayPATPAT1023.exe
3112	ayPATPAT1023.exe
4948	attrib.exe
4256	ayPATPAT1023.exe
568	ayPATPAT1023.exe
2704	attrib.exe
452	ayPATPAT1023.exe
4920	attrib.exe
1732	cmd.exe
4032	ayPATPAT1023.exe
1628	ayPATPAT1023.exe
452	ayPATPAT1023.exe
5192	Conhost.exe
5244	ayPATPAT1023.exe
5332	ayPATPAT1023.exe
5400	ayPATPAT1023.exe
5452	ayPATPAT1023.exe
5536	ayPATPAT1023.exe
5652	attrib.exe
5804	cmd.exe
5848	ayPATPAT1023.exe
5992	ayPATPAT1023.exe
6056	ayPATPAT1023.exe
5172	ayPATPAT1023.exe
5156	ayPATPAT1023.exe
5532	ayPATPAT1023.exe
5620	ayPATPAT1023.exe
5880	attrib.exe
5748	ayPATPAT1023.exe
2568	ayPATPAT1023.exe
5692	ayPATPAT1023.exe
5432	ayPATPAT1023.exe
5196	ayPATPAT1023.exe
6016	cmd.exe
6236	ayPATPAT1023.exe
6300	cmd.exe
6436	ayPATPAT1023.exe
6560	ayPATPAT1023.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\ayPATPAT1023.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\ayPATPAT1023.exe	ayPATPAT1023.exe
File created	C:\Windows\SysWOW64\ayPATPAT1023.exe	Conhost.exe
File opened for modification	C:\Windows\SysWOW64\ayPATPAT1023.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\ayPATPAT1023.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\ayPATPAT1023.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\ayPATPAT1023.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\ayPATPAT1023.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\ayPATPAT1023.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\ayPATPAT1023.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\ayPATPAT1023.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\ayPATPAT1023.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\ayPATPAT1023.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\ayPATPAT1023.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\ayPATPAT1023.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\ayPATPAT1023.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\ayPATPAT1023.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\ayPATPAT1023.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\ayPATPAT1023.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\ayPATPAT1023.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\ayPATPAT1023.exe	attrib.exe
File created	C:\Windows\SysWOW64\ayPATPAT1023.exe	ayPATPAT1023.exe
File created	C:\Windows\SysWOW64\ayPATPAT1023.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\ayPATPAT1023.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\ayPATPAT1023.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\ayPATPAT1023.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\ayPATPAT1023.exe	ayPATPAT1023.exe
File opened for modification	C:\Windows\SysWOW64\ayPATPAT1023.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\ayPATPAT1023.exe	attrib.exe
File created	C:\Windows\SysWOW64\ayPATPAT1023.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\ayPATPAT1023.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\ayPATPAT1023.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\ayPATPAT1023.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\ayPATPAT1023.exe	attrib.exe
File created	C:\Windows\SysWOW64\ayPATPAT1023.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\ayPATPAT1023.exe	attrib.exe
File created	C:\Windows\SysWOW64\ayPATPAT1023.exe	ayPATPAT1023.exe
File opened for modification	C:\Windows\SysWOW64\ayPATPAT1023.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\ayPATPAT1023.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\ayPATPAT1023.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\ayPATPAT1023.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\ayPATPAT1023.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\ayPATPAT1023.exe	Process not Found
File created	C:\Windows\SysWOW64\ayPATPAT1023.exe	Conhost.exe
File opened for modification	C:\Windows\SysWOW64\ayPATPAT1023.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\ayPATPAT1023.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\ayPATPAT1023.exe	attrib.exe
File created	C:\Windows\SysWOW64\ayPATPAT1023.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\ayPATPAT1023.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\ayPATPAT1023.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\ayPATPAT1023.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\ayPATPAT1023.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\ayPATPAT1023.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\ayPATPAT1023.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\ayPATPAT1023.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\ayPATPAT1023.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\ayPATPAT1023.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\ayPATPAT1023.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\ayPATPAT1023.exe	Process not Found
File created	C:\Windows\SysWOW64\ayPATPAT1023.exe	Process not Found
File created	C:\Windows\SysWOW64\ayPATPAT1023.exe	ayPATPAT1023.exe
File opened for modification	C:\Windows\SysWOW64\ayPATPAT1023.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\ayPATPAT1023.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\ayPATPAT1023.exe	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 1876	1224	03cc81994173a2270d4a42ec620fc289.exe	88
PID 1224 wrote to memory of 1876	1224	03cc81994173a2270d4a42ec620fc289.exe	88
PID 1224 wrote to memory of 1876	1224	03cc81994173a2270d4a42ec620fc289.exe	88
PID 1224 wrote to memory of 3704	1224	03cc81994173a2270d4a42ec620fc289.exe	90
PID 1224 wrote to memory of 3704	1224	03cc81994173a2270d4a42ec620fc289.exe	90
PID 1224 wrote to memory of 3704	1224	03cc81994173a2270d4a42ec620fc289.exe	90
PID 3704 wrote to memory of 1624	3704	ayPATPAT1023.exe	91
PID 3704 wrote to memory of 1624	3704	ayPATPAT1023.exe	91
PID 3704 wrote to memory of 1624	3704	ayPATPAT1023.exe	91
PID 3704 wrote to memory of 1144	3704	ayPATPAT1023.exe	92
PID 3704 wrote to memory of 1144	3704	ayPATPAT1023.exe	92
PID 3704 wrote to memory of 1144	3704	ayPATPAT1023.exe	92
PID 1144 wrote to memory of 4520	1144	ayPATPAT1023.exe	95
PID 1144 wrote to memory of 4520	1144	ayPATPAT1023.exe	95
PID 1144 wrote to memory of 4520	1144	ayPATPAT1023.exe	95
PID 1144 wrote to memory of 3892	1144	ayPATPAT1023.exe	1098
PID 1144 wrote to memory of 3892	1144	ayPATPAT1023.exe	1098
PID 1144 wrote to memory of 3892	1144	ayPATPAT1023.exe	1098
PID 1876 wrote to memory of 1860	1876	cmd.exe	1139
PID 1876 wrote to memory of 1860	1876	cmd.exe	1139
PID 1876 wrote to memory of 1860	1876	cmd.exe	1139
PID 3892 wrote to memory of 3696	3892	ayPATPAT1023.exe	1138
PID 3892 wrote to memory of 3696	3892	ayPATPAT1023.exe	1138
PID 3892 wrote to memory of 3696	3892	ayPATPAT1023.exe	1138
PID 3892 wrote to memory of 1844	3892	ayPATPAT1023.exe	1137
PID 3892 wrote to memory of 1844	3892	ayPATPAT1023.exe	1137
PID 3892 wrote to memory of 1844	3892	ayPATPAT1023.exe	1137
PID 1844 wrote to memory of 1496	1844	ayPATPAT1023.exe	1136
PID 1844 wrote to memory of 1496	1844	ayPATPAT1023.exe	1136
PID 1844 wrote to memory of 1496	1844	ayPATPAT1023.exe	1136
PID 1844 wrote to memory of 1316	1844	ayPATPAT1023.exe	1135
PID 1844 wrote to memory of 1316	1844	ayPATPAT1023.exe	1135
PID 1844 wrote to memory of 1316	1844	ayPATPAT1023.exe	1135
PID 1316 wrote to memory of 528	1316	ayPATPAT1023.exe	1134
PID 1316 wrote to memory of 528	1316	ayPATPAT1023.exe	1134
PID 1316 wrote to memory of 528	1316	ayPATPAT1023.exe	1134
PID 1316 wrote to memory of 1996	1316	ayPATPAT1023.exe	1133
PID 1316 wrote to memory of 1996	1316	ayPATPAT1023.exe	1133
PID 1316 wrote to memory of 1996	1316	ayPATPAT1023.exe	1133
PID 1996 wrote to memory of 3508	1996	ayPATPAT1023.exe	100
PID 1996 wrote to memory of 3508	1996	ayPATPAT1023.exe	100
PID 1996 wrote to memory of 3508	1996	ayPATPAT1023.exe	100
PID 1996 wrote to memory of 1608	1996	ayPATPAT1023.exe	154
PID 1996 wrote to memory of 1608	1996	ayPATPAT1023.exe	154
PID 1996 wrote to memory of 1608	1996	ayPATPAT1023.exe	154
PID 1624 wrote to memory of 3620	1624	cmd.exe	101
PID 1624 wrote to memory of 3620	1624	cmd.exe	101
PID 1624 wrote to memory of 3620	1624	cmd.exe	101
PID 1608 wrote to memory of 4848	1608	Conhost.exe	1130
PID 1608 wrote to memory of 4848	1608	Conhost.exe	1130
PID 1608 wrote to memory of 4848	1608	Conhost.exe	1130
PID 1608 wrote to memory of 4092	1608	Conhost.exe	1129
PID 1608 wrote to memory of 4092	1608	Conhost.exe	1129
PID 1608 wrote to memory of 4092	1608	Conhost.exe	1129
PID 4092 wrote to memory of 4336	4092	ayPATPAT1023.exe	1127
PID 4092 wrote to memory of 4336	4092	ayPATPAT1023.exe	1127
PID 4092 wrote to memory of 4336	4092	ayPATPAT1023.exe	1127
PID 4092 wrote to memory of 3164	4092	ayPATPAT1023.exe	1126
PID 4092 wrote to memory of 3164	4092	ayPATPAT1023.exe	1126
PID 4092 wrote to memory of 3164	4092	ayPATPAT1023.exe	1126
PID 3164 wrote to memory of 3432	3164	ayPATPAT1023.exe	1125
PID 3164 wrote to memory of 3432	3164	ayPATPAT1023.exe	1125
PID 3164 wrote to memory of 3432	3164	ayPATPAT1023.exe	1125
PID 3164 wrote to memory of 2704	3164	ayPATPAT1023.exe	1093

Views/modifies file attributes 1 TTPs 64 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
9176	attrib.exe
13752	Process not Found
13104	Process not Found
10576	Process not Found
12716	Process not Found
8788	attrib.exe
3568	attrib.exe
6592	attrib.exe
9992	attrib.exe
7628	Process not Found
12904	Process not Found
11008	attrib.exe
5756	attrib.exe
11928	attrib.exe
7824	attrib.exe
3664	attrib.exe
11552	attrib.exe
10520	Process not Found
11060	Process not Found
4312	attrib.exe
4144	attrib.exe
5216	attrib.exe
14872	Process not Found
4416	attrib.exe
14848	Process not Found
8712	attrib.exe
6580	attrib.exe
4540	attrib.exe
12836	Process not Found
14312	Process not Found
10664	attrib.exe
9464	attrib.exe
12548	Process not Found
15164	Process not Found
11060	attrib.exe
6084	attrib.exe
13104	Process not Found
4408	attrib.exe
11328	Process not Found
13008	Process not Found
9692	attrib.exe
7224	attrib.exe
5900	attrib.exe
11460	Process not Found
14672	Process not Found
8256	attrib.exe
4508	attrib.exe
8920	attrib.exe
12632	Process not Found
13072	Process not Found
11244	Process not Found
13680	Process not Found
9384	attrib.exe
11824	Process not Found
12528	Process not Found
9616	Process not Found
12852	Process not Found
216	Process not Found
12128	Process not Found
14368	Process not Found
9004	attrib.exe
9724	attrib.exe
5880	attrib.exe
14420	Process not Found

C:\Users\Admin\AppData\Local\Temp\03cc81994173a2270d4a42ec620fc289.exe
"C:\Users\Admin\AppData\Local\Temp\03cc81994173a2270d4a42ec620fc289.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\e7dda737da15240633031.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1876
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Users\Admin\AppData\Local\Temp\03cc81994173a2270d4a42ec620fc289.exe" -r -a -s -h
    3⤵
    PID:1860
- C:\Windows\SysWOW64\ayPATPAT1023.exe
  C:\Windows\system32\ayPATPAT1023.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3704
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\e7dda737da15240633171.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1624
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
      4⤵
      PID:3620
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
      4⤵
      PID:864
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
      4⤵
      PID:5740
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
      4⤵
      PID:6568
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
      4⤵
      PID:7232
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
      4⤵
      PID:7516
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
      4⤵
      PID:9408
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
      4⤵
      PID:9532
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
      4⤵
      Drops file in System32 directory
      PID:9188
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
      4⤵
      PID:7796
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
      4⤵
      Views/modifies file attributes
      PID:3664
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
      4⤵
      PID:11712
- - C:\Windows\SysWOW64\ayPATPAT1023.exe
    C:\Windows\system32\ayPATPAT1023.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1144
  - - C:\Windows\SysWOW64\ayPATPAT1023.exe
      C:\Windows\system32\ayPATPAT1023.exe
      4⤵
      PID:3892
    - - C:\Windows\SysWOW64\ayPATPAT1023.exe
        
        C:\Windows\system32\ayPATPAT1023.exe
        5⤵
        Executes dropped EXE
        
        PID:4328
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\e7dda737da15240634078.bat
        5⤵
        
        PID:4568
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\e7dda737da15240633218.bat
      4⤵
      PID:4520
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        5⤵
        
        PID:4424
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        5⤵
        Drops file in System32 directory
        
        PID:8516
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        6⤵
        
        PID:8592
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        6⤵
        
        PID:10164
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        5⤵
        
        PID:10388
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        5⤵
        
        PID:7224
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        5⤵
        
        PID:6656
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        5⤵
        Views/modifies file attributes
        
        PID:5756
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        5⤵
        Views/modifies file attributes
        
        PID:4508
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        5⤵
        
        PID:4024
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        6⤵
        
        PID:10680
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        5⤵
        
        PID:10268

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
PID:1608

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240633328.bat
1⤵
PID:3508
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:8976
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:10760
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:8380
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:6424
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:4488
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:564
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:556

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
PID:2704
- C:\Windows\SysWOW64\ayPATPAT1023.exe
  C:\Windows\system32\ayPATPAT1023.exe
  2⤵
  PID:3728
- - C:\Windows\SysWOW64\ayPATPAT1023.exe
    C:\Windows\system32\ayPATPAT1023.exe
    3⤵
    PID:4592
  - - C:\Windows\SysWOW64\ayPATPAT1023.exe
      C:\Windows\system32\ayPATPAT1023.exe
      4⤵
      Executes dropped EXE
      PID:4120
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\e7dda737da15240634546.bat
        5⤵
        
        PID:4424
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        6⤵
        
        PID:6528
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        6⤵
        
        PID:7268
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        6⤵
        
        PID:8356
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        6⤵
        
        PID:8596
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        6⤵
        
        PID:440
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        6⤵
        
        PID:11296
    - - C:\Windows\SysWOW64\ayPATPAT1023.exe
        
        C:\Windows\system32\ayPATPAT1023.exe
        5⤵
        Executes dropped EXE
        
        PID:3112
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\e7dda737da15240634328.bat
      4⤵
      PID:4956
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        5⤵
        
        PID:1964
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        5⤵
        Drops file in System32 directory
        
        PID:6444
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        5⤵
        
        PID:7992
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        5⤵
        
        PID:11020
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        5⤵
        
        PID:8640
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        5⤵
        Views/modifies file attributes
        
        PID:7224
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        5⤵
        
        PID:5712
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        5⤵
        
        PID:9452
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\e7dda737da15240634312.bat
    3⤵
    PID:4528
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
      4⤵
      PID:5704
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
      4⤵
      PID:7528
    - - C:\Windows\SysWOW64\ayPATPAT1023.exe
        
        C:\Windows\system32\ayPATPAT1023.exe
        5⤵
        
        PID:8248
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\e7dda737da15240643046.bat
        5⤵
        
        PID:9632
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        6⤵
        
        PID:11288
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
      4⤵
      PID:9948
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
      4⤵
      PID:7004
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        5⤵
        
        PID:11280
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
      4⤵
      PID:6812
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
      4⤵
      Drops file in System32 directory
      PID:2156
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:1040
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
      4⤵
      PID:1228
- C:\Windows\SysWOW64\ayPATPAT1023.exe
  C:\Windows\system32\ayPATPAT1023.exe
  2⤵
  PID:452
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\e7dda737da15240634984.bat
  2⤵
  PID:4024
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:6064
  - - C:\Windows\SysWOW64\ayPATPAT1023.exe
      C:\Windows\system32\ayPATPAT1023.exe
      4⤵
      PID:6592
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\e7dda737da15240637734.bat
        5⤵
        
        PID:6320
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        6⤵
        
        PID:8000
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        6⤵
        Views/modifies file attributes
        
        PID:11008
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        6⤵
        
        PID:3568
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        6⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\ayPATPAT1023.exe
        
        C:\Windows\system32\ayPATPAT1023.exe
        7⤵
        
        PID:6812
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        6⤵
        
        PID:10044
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\e7dda737da15240637687.bat
      4⤵
      PID:5944
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:6976
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:8524
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:7872
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:7880

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:2692

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
- Executes dropped EXE
PID:4720
- C:\Windows\SysWOW64\ayPATPAT1023.exe
  C:\Windows\system32\ayPATPAT1023.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\e7dda737da15240633625.bat
  2⤵
  PID:3776
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:11352

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:2156

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
- Executes dropped EXE
PID:3928
- C:\Windows\SysWOW64\ayPATPAT1023.exe
  C:\Windows\system32\ayPATPAT1023.exe
  2⤵
  PID:1040
- - C:\Windows\SysWOW64\ayPATPAT1023.exe
    C:\Windows\system32\ayPATPAT1023.exe
    3⤵
    - Executes dropped EXE
    PID:4428
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\e7dda737da15240633765.bat
      4⤵
      PID:1400
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        5⤵
        Drops file in System32 directory
        
        PID:2736
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        5⤵
        
        PID:8264
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        5⤵
        
        PID:7592
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        5⤵
        
        PID:8888
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        5⤵
        
        PID:6540
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        5⤵
        
        PID:5688
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        5⤵
        
        PID:2476
  - - C:\Windows\SysWOW64\ayPATPAT1023.exe
      C:\Windows\system32\ayPATPAT1023.exe
      4⤵
      Executes dropped EXE
      PID:4544
    - - C:\Windows\SysWOW64\ayPATPAT1023.exe
        
        C:\Windows\system32\ayPATPAT1023.exe
        5⤵
        Executes dropped EXE
        
        PID:864
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\e7dda737da15240633796.bat
        5⤵
        
        PID:3020
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\e7dda737da15240633734.bat
    3⤵
    PID:436
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
      4⤵
      PID:6596
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
      4⤵
      PID:8576
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
      4⤵
      PID:9616
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
      4⤵
      Drops file in System32 directory
      PID:9312
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
      4⤵
      Drops file in System32 directory
      PID:7388
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
      4⤵
      PID:5676
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        5⤵
        
        PID:11224
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
      4⤵
      PID:4060
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\e7dda737da15240633671.bat
  2⤵
  PID:5060
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:11408

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:4800

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:2564

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240633953.bat
1⤵
PID:1696
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:1600
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:6148
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:7868
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:9176
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:10060
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:7988
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:3664
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:10672

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
- Executes dropped EXE
PID:4968
- C:\Windows\SysWOW64\ayPATPAT1023.exe
  C:\Windows\system32\ayPATPAT1023.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3892
- - C:\Windows\SysWOW64\ayPATPAT1023.exe
    C:\Windows\system32\ayPATPAT1023.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1844
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\e7dda737da15240633250.bat
    3⤵
    PID:3696
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
      4⤵
      PID:11448
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\e7dda737da15240634031.bat
  2⤵
  PID:784

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240634140.bat
1⤵
PID:4228
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:6192
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:9144
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:10632
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:8156
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  - Drops file in System32 directory
  PID:5680
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:4396

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:3816

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240634187.bat
1⤵
PID:3240
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  - Views/modifies file attributes
  PID:4312
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:6136
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:7356
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:9160
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:11200
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:10164
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:7908
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:11088
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:6588
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\e7dda737da15240638968.bat
    3⤵
    - Drops file in System32 directory
    PID:7356
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
      4⤵
      Drops file in System32 directory
      PID:9220
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  - Drops file in System32 directory
  PID:9328
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:6612
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:4312

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:1628
- C:\Windows\SysWOW64\ayPATPAT1023.exe
  C:\Windows\system32\ayPATPAT1023.exe
  2⤵
  - Executes dropped EXE
  PID:452
- - C:\Windows\SysWOW64\ayPATPAT1023.exe
    C:\Windows\system32\ayPATPAT1023.exe
    3⤵
    PID:5192
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\e7dda737da15240635250.bat
    3⤵
    PID:5180
- - C:\Windows\SysWOW64\ayPATPAT1023.exe
    C:\Windows\system32\ayPATPAT1023.exe
    3⤵
    PID:4920
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\e7dda737da15240635046.bat
    3⤵
    PID:4824
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
      4⤵
      PID:11400

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:1420

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:3204

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:752

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:4488

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:3808

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
- Executes dropped EXE
PID:568
- C:\Windows\SysWOW64\ayPATPAT1023.exe
  C:\Windows\system32\ayPATPAT1023.exe
  2⤵
  PID:2704
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\e7dda737da15240634703.bat
  2⤵
  PID:2968

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240634671.bat
1⤵
PID:4576
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:5856
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  - Drops file in System32 directory
  PID:8460
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:8352
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:9304
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:6440
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:1420

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
- Executes dropped EXE
PID:4256

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240634625.bat
1⤵
PID:2428
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:5712
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:5832
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:7508
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:7112
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:10192
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:8776
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  - Views/modifies file attributes
  PID:9724
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:7268
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:7212
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:6060
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:5272
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:10688

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:3816

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
PID:4948

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:4144

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Windows\SysWOW64\ayPATPAT1023.exe
  C:\Windows\system32\ayPATPAT1023.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4092
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\e7dda737da15240633390.bat
  2⤵
  PID:4848
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:11376

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:1148

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:3204

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:4104

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
PID:1732
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:8552
- - C:\Windows\SysWOW64\ayPATPAT1023.exe
    C:\Windows\system32\ayPATPAT1023.exe
    3⤵
    PID:9508
  - - C:\Windows\SysWOW64\ayPATPAT1023.exe
      C:\Windows\system32\ayPATPAT1023.exe
      4⤵
      PID:9556
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\e7dda737da15240641234.bat
      4⤵
      PID:9548
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        5⤵
        
        PID:9416
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        5⤵
        
        PID:11456
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\e7dda737da15240641171.bat
    3⤵
    PID:9484
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
      4⤵
      PID:9848
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
      4⤵
      Views/modifies file attributes
      PID:9176
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:9420
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:11068
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:6724
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:6064

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:2692

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:5156
- C:\Windows\SysWOW64\ayPATPAT1023.exe
  C:\Windows\system32\ayPATPAT1023.exe
  2⤵
  - Executes dropped EXE
  PID:5532
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\e7dda737da15240635953.bat
  2⤵
  PID:4408

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240635343.bat
1⤵
PID:5320
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  - Views/modifies file attributes
  PID:3568
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:10280
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:10204
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:6588
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:2188
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:11504

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240635453.bat
1⤵
PID:5516
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:5900
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:8500
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:9380
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:7680
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:7340

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
- Executes dropped EXE
PID:5536
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\e7dda737da15240635546.bat
  2⤵
  PID:5628
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:9052
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:8964
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
      4⤵
      PID:9144
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:9524
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:10816
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:6692
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:6484
- C:\Windows\SysWOW64\ayPATPAT1023.exe
  C:\Windows\system32\ayPATPAT1023.exe
  2⤵
  PID:5652
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\e7dda737da15240635609.bat
    3⤵
    PID:5772
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
      4⤵
      PID:7672
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
      4⤵
      PID:8420
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
      4⤵
      PID:6652
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
      4⤵
      PID:9984
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
      4⤵
      Executes dropped EXE
      Views/modifies file attributes
      PID:5880
- - C:\Windows\SysWOW64\ayPATPAT1023.exe
    C:\Windows\system32\ayPATPAT1023.exe
    3⤵
    PID:5804

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:5572
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:9108
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:9380
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:10776

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:5748

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:5924

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240635734.bat
1⤵
PID:5960
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  - Views/modifies file attributes
  PID:6580
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:9248
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:10852
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:8088
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:6500

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:6012

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
- Executes dropped EXE
PID:6056
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\e7dda737da15240635843.bat
  2⤵
  PID:1628
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:8636
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    - Drops file in System32 directory
    PID:10528
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:8204
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:7684
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:6936
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\e7dda737da15240635218.bat
    3⤵
    - Executes dropped EXE
    PID:1732
  - - C:\Windows\SysWOW64\ayPATPAT1023.exe
      C:\Windows\system32\ayPATPAT1023.exe
      4⤵
      Executes dropped EXE
      PID:4032
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\e7dda737da15240635156.bat
      4⤵
      PID:1620
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        5⤵
        
        PID:7872
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
      4⤵
      PID:10664
- C:\Windows\SysWOW64\ayPATPAT1023.exe
  C:\Windows\system32\ayPATPAT1023.exe
  2⤵
  - Executes dropped EXE
  PID:5172

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:6088

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:5216

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
- Executes dropped EXE
PID:4948

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240636031.bat
1⤵
PID:5852
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:6588
- - C:\Windows\SysWOW64\ayPATPAT1023.exe
    C:\Windows\system32\ayPATPAT1023.exe
    3⤵
    PID:6976
  - - C:\Windows\SysWOW64\ayPATPAT1023.exe
      C:\Windows\system32\ayPATPAT1023.exe
      4⤵
      PID:7192
    - - C:\Windows\SysWOW64\ayPATPAT1023.exe
        
        C:\Windows\system32\ayPATPAT1023.exe
        5⤵
        
        PID:6388
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\e7dda737da15240639062.bat
        5⤵
        
        PID:7900
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        6⤵
        
        PID:8204
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        6⤵
        
        PID:10884
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        6⤵
        
        PID:8880
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\e7dda737da15240639000.bat
      4⤵
      PID:7544
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6976
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        5⤵
        
        PID:7628
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        5⤵
        
        PID:10044
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        5⤵
        
        PID:7896
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        5⤵
        
        PID:11496
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  - Drops file in System32 directory
  PID:7768
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  - Views/modifies file attributes
  PID:9004
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:8440
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:11220

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
PID:5880
- C:\Windows\SysWOW64\ayPATPAT1023.exe
  C:\Windows\system32\ayPATPAT1023.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:5748
- - C:\Windows\SysWOW64\ayPATPAT1023.exe
    C:\Windows\system32\ayPATPAT1023.exe
    3⤵
    - Executes dropped EXE
    PID:2568
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\e7dda737da15240636250.bat
    3⤵
    PID:5752
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\e7dda737da15240636156.bat
  2⤵
  PID:2640
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:8056
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:9964
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    - Drops file in System32 directory
    PID:10420
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:7188
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:5216

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:3540

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:4480

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:5268
- C:\Windows\SysWOW64\ayPATPAT1023.exe
  C:\Windows\system32\ayPATPAT1023.exe
  2⤵
  PID:5428
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\e7dda737da15240637171.bat
  2⤵
  PID:5996
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:8044
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:9064
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:9272
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:11472

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
- Executes dropped EXE
PID:5432
- C:\Windows\SysWOW64\ayPATPAT1023.exe
  C:\Windows\system32\ayPATPAT1023.exe
  2⤵
  - Executes dropped EXE
  PID:5196
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\e7dda737da15240636375.bat
  2⤵
  PID:1820
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:10248

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
PID:6016
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:6904
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:9256
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:10624
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:7104

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240636437.bat
1⤵
PID:5244
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:7996
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:4636
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:10056
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:6968
- C:\Windows\SysWOW64\ayPATPAT1023.exe
  C:\Windows\system32\ayPATPAT1023.exe
  2⤵
  - Executes dropped EXE
  PID:5332

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:6164

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
PID:6300
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:5196
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:6388
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:9956

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:6460

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:6724

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
PID:6836
- C:\Windows\SysWOW64\ayPATPAT1023.exe
  C:\Windows\system32\ayPATPAT1023.exe
  2⤵
  PID:6960
- - C:\Windows\SysWOW64\ayPATPAT1023.exe
    C:\Windows\system32\ayPATPAT1023.exe
    3⤵
    PID:7072
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\e7dda737da15240637015.bat
    3⤵
    PID:7060
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
      4⤵
      PID:10072

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240636875.bat
1⤵
PID:6828
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  - Drops file in System32 directory
  PID:8512
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:8508
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:6992
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:7188
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:11156

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:6992

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
PID:7136
- C:\Windows\SysWOW64\ayPATPAT1023.exe
  C:\Windows\system32\ayPATPAT1023.exe
  2⤵
  PID:5268
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\e7dda737da15240637125.bat
  2⤵
  - Executes dropped EXE
  PID:6016
- - C:\Windows\SysWOW64\ayPATPAT1023.exe
    C:\Windows\system32\ayPATPAT1023.exe
    3⤵
    - Executes dropped EXE
    PID:6236
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\e7dda737da15240636484.bat
    3⤵
    PID:6224
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
      4⤵
      PID:10856

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:5304

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:5888

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
PID:6584
- C:\Windows\SysWOW64\ayPATPAT1023.exe
  C:\Windows\system32\ayPATPAT1023.exe
  2⤵
  PID:6932
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\e7dda737da15240637421.bat
    3⤵
    PID:7076
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
      4⤵
      PID:9176
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
      4⤵
      PID:8808
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
      4⤵
      PID:6796
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
      4⤵
      PID:10744
- - C:\Windows\SysWOW64\ayPATPAT1023.exe
    C:\Windows\system32\ayPATPAT1023.exe
    3⤵
    PID:6936
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\e7dda737da15240637531.bat
      4⤵
      PID:6412
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6148
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        5⤵
        
        PID:7908
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        5⤵
        
        PID:7636
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        5⤵
        Drops file in System32 directory
        
        PID:9296
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        5⤵
        
        PID:10728
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        5⤵
        
        PID:9380
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        5⤵
        
        PID:8716
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        5⤵
        
        PID:7368
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        5⤵
        
        PID:11224
  - - C:\Windows\SysWOW64\ayPATPAT1023.exe
      C:\Windows\system32\ayPATPAT1023.exe
      4⤵
      PID:6160
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        5⤵
        
        PID:11136

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:7084

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240637562.bat
1⤵
- Executes dropped EXE
PID:5804
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:7004
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:9984
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:6944
- C:\Windows\SysWOW64\ayPATPAT1023.exe
  C:\Windows\system32\ayPATPAT1023.exe
  2⤵
  - Executes dropped EXE
  PID:5848
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\e7dda737da15240635671.bat
  2⤵
  PID:5840
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:11520
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:11368

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:6736

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:5856

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:6652

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
PID:7460
- C:\Windows\SysWOW64\ayPATPAT1023.exe
  C:\Windows\system32\ayPATPAT1023.exe
  2⤵
  PID:7588
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\e7dda737da15240638140.bat
  2⤵
  PID:7572

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240638171.bat
1⤵
PID:7640
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:7372
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:8328
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:7672
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:11432

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:7764

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:7824

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:7892

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:7936

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
PID:8052
- C:\Windows\SysWOW64\ayPATPAT1023.exe
  C:\Windows\system32\ayPATPAT1023.exe
  2⤵
  PID:2372
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\e7dda737da15240638500.bat
  2⤵
  PID:6744

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:6996

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240638562.bat
1⤵
PID:7464
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:9084
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:8496
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:10308

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
PID:6216
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\e7dda737da15240638812.bat
  2⤵
  PID:6636
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:7316
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:9460
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:10692
- - C:\Windows\SysWOW64\ayPATPAT1023.exe
    C:\Windows\system32\ayPATPAT1023.exe
    3⤵
    PID:6064
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\e7dda737da15240637609.bat
    3⤵
    PID:6028
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
      4⤵
      PID:11048
- C:\Windows\SysWOW64\ayPATPAT1023.exe
  C:\Windows\system32\ayPATPAT1023.exe
  2⤵
  PID:7424

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:7512

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:7660

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:7608

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240639312.bat
1⤵
PID:8340
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:8608
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:8556
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:6764
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:11720
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:9380

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
PID:8380
- C:\Windows\SysWOW64\ayPATPAT1023.exe
  C:\Windows\system32\ayPATPAT1023.exe
  2⤵
  PID:8500
- - C:\Windows\SysWOW64\ayPATPAT1023.exe
    C:\Windows\system32\ayPATPAT1023.exe
    3⤵
    PID:8668
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\e7dda737da15240639562.bat
      4⤵
      PID:8800
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        5⤵
        
        PID:9412
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        5⤵
        
        PID:7268
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        5⤵
        
        PID:11088
  - - C:\Windows\SysWOW64\ayPATPAT1023.exe
      C:\Windows\system32\ayPATPAT1023.exe
      4⤵
      PID:8828
    - - C:\Windows\SysWOW64\ayPATPAT1023.exe
        
        C:\Windows\system32\ayPATPAT1023.exe
        5⤵
        
        PID:9044
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\e7dda737da15240639718.bat
        5⤵
        
        PID:9036
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        6⤵
        
        PID:9240
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        6⤵
        
        PID:10900
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\e7dda737da15240639500.bat
    3⤵
    PID:8660
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
      4⤵
      PID:8996
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
      4⤵
      PID:10044
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
      4⤵
      PID:10416
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\e7dda737da15240639375.bat
  2⤵
  PID:8448
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:7660
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:11416

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:8408

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:8432

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:8600

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:8724

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:8712

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:8696

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:8736

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:8628

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:8592

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:8872

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:8908

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:9008

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
PID:9188
- C:\Windows\SysWOW64\ayPATPAT1023.exe
  C:\Windows\system32\ayPATPAT1023.exe
  2⤵
  PID:6740
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\e7dda737da15240639921.bat
  2⤵
  PID:8288
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:8668
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:7988
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:3476

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:7796

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
PID:6192
- C:\Windows\SysWOW64\ayPATPAT1023.exe
  C:\Windows\system32\ayPATPAT1023.exe
  2⤵
  PID:112
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\e7dda737da15240640062.bat
  2⤵
  PID:6032
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:8280
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:9640
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:7336

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:8564

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
PID:7928
- C:\Windows\SysWOW64\ayPATPAT1023.exe
  C:\Windows\system32\ayPATPAT1023.exe
  2⤵
  PID:8280
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\e7dda737da15240640234.bat
    3⤵
    PID:8244
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
      4⤵
      PID:5196
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
      4⤵
      PID:9220
- - C:\Windows\SysWOW64\ayPATPAT1023.exe
    C:\Windows\system32\ayPATPAT1023.exe
    3⤵
    PID:8596
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\e7dda737da15240640171.bat
  2⤵
  PID:9024
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:8852
  - - C:\Windows\SysWOW64\ayPATPAT1023.exe
      C:\Windows\system32\ayPATPAT1023.exe
      4⤵
      PID:10312
    - - C:\Windows\SysWOW64\ayPATPAT1023.exe
        
        C:\Windows\system32\ayPATPAT1023.exe
        5⤵
        
        PID:10372
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\e7dda737da15240643359.bat
        5⤵
        
        PID:10364
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:9976

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:9128

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:7192

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:7984

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240640140.bat
1⤵
PID:9032
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:7188
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:7268

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:8788

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:7436

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:8976

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:8508

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:7884

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:8772

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:8712

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
PID:7440
- C:\Windows\SysWOW64\ayPATPAT1023.exe
  C:\Windows\system32\ayPATPAT1023.exe
  2⤵
  PID:7044
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\e7dda737da15240640703.bat
    3⤵
    PID:8656
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
      4⤵
      PID:9260
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
      4⤵
      PID:10696
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\e7dda737da15240640578.bat
  2⤵
  PID:7928
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:7952
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:8380
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:10500
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:10388

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240640484.bat
1⤵
PID:7996
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:7884
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:8620

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:8816

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:8432

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:7656

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
PID:7804

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240640406.bat
1⤵
PID:8516

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:8532

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:8308

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:8596
- C:\Windows\SysWOW64\ayPATPAT1023.exe
  C:\Windows\system32\ayPATPAT1023.exe
  2⤵
  PID:7896
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\e7dda737da15240640328.bat
  2⤵
  PID:9192
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:8056
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:7044
  - - C:\Windows\SysWOW64\ayPATPAT1023.exe
      C:\Windows\system32\ayPATPAT1023.exe
      4⤵
      PID:8552

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:9096

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:9084

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:8468

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:7988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\e7dda737da15240644031.bat
  2⤵
  PID:6764
- C:\Windows\SysWOW64\ayPATPAT1023.exe
  C:\Windows\system32\ayPATPAT1023.exe
  2⤵
  PID:9944
- - C:\Windows\SysWOW64\ayPATPAT1023.exe
    C:\Windows\system32\ayPATPAT1023.exe
    3⤵
    PID:9512
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\e7dda737da15240643875.bat
    3⤵
    PID:10820
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
      4⤵
      PID:9944

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:9204

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:8364

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:8980

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:9068

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:7392

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240640000.bat
1⤵
PID:6692
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:7388
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:6796

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:8348

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:8132

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:8100

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:8048

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:7312

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:9152

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240639781.bat
1⤵
PID:9136
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:10548
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:7436

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:9000

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:8992

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:8984

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:8968

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:8820

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
- Drops file in System32 directory
PID:8476

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:8468

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:8388

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:8308

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:7444

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
- Drops file in System32 directory
PID:6624

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:7392
- C:\Windows\SysWOW64\ayPATPAT1023.exe
  C:\Windows\system32\ayPATPAT1023.exe
  2⤵
  - Drops file in System32 directory
  PID:9284
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\e7dda737da15240642703.bat
  2⤵
  PID:9424

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:9400

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:9452

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
PID:9708
- C:\Windows\SysWOW64\ayPATPAT1023.exe
  C:\Windows\system32\ayPATPAT1023.exe
  2⤵
  PID:10032
- - C:\Windows\SysWOW64\ayPATPAT1023.exe
    C:\Windows\system32\ayPATPAT1023.exe
    3⤵
    PID:10200
  - - C:\Windows\SysWOW64\ayPATPAT1023.exe
      C:\Windows\system32\ayPATPAT1023.exe
      4⤵
      PID:9048
    - - C:\Windows\SysWOW64\ayPATPAT1023.exe
        
        C:\Windows\system32\ayPATPAT1023.exe
        5⤵
        Drops file in System32 directory
        
        PID:8000
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\e7dda737da15240641750.bat
        6⤵
        
        PID:8976
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        7⤵
        
        PID:9892
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        7⤵
        
        PID:10380
      - C:\Windows\SysWOW64\ayPATPAT1023.exe
        
        C:\Windows\system32\ayPATPAT1023.exe
        6⤵
        
        PID:8556
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\e7dda737da15240641687.bat
        5⤵
        
        PID:8352
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        6⤵
        
        PID:9232
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        6⤵
        
        PID:11440
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\e7dda737da15240641578.bat
      4⤵
      PID:8520
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        5⤵
        
        PID:10336
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        5⤵
        
        PID:9492
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\e7dda737da15240641500.bat
    3⤵
    PID:10180
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:9008
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
      4⤵
      PID:9968
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
      4⤵
      Drops file in System32 directory
      PID:10860
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
      4⤵
      PID:11220
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\e7dda737da15240641421.bat
  2⤵
  PID:10024
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:9624
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:10676

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240641328.bat
1⤵
PID:9700
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:8992
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:11360

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
PID:9612

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240641265.bat
1⤵
PID:9600
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:11248
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:9360

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
- Drops file in System32 directory
PID:10160

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:9440

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:9392

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:9372

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:9360

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:8600

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:8920

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:9324

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:9316

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
PID:8588
- C:\Windows\SysWOW64\ayPATPAT1023.exe
  C:\Windows\system32\ayPATPAT1023.exe
  2⤵
  PID:8308
- - C:\Windows\SysWOW64\ayPATPAT1023.exe
    C:\Windows\system32\ayPATPAT1023.exe
    3⤵
    PID:9688
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\e7dda737da15240641937.bat
    3⤵
    PID:9596
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
      4⤵
      PID:9012
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\e7dda737da15240641859.bat
  2⤵
  PID:9172
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    - Drops file in System32 directory
    PID:9556
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:10072
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:10788

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240641812.bat
1⤵
PID:9128
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:3764

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:9068

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:9532

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:8508

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:8312

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:8788

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:9308

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:9284
- C:\Windows\SysWOW64\ayPATPAT1023.exe
  C:\Windows\system32\ayPATPAT1023.exe
  2⤵
  PID:9812
- - C:\Windows\SysWOW64\ayPATPAT1023.exe
    C:\Windows\system32\ayPATPAT1023.exe
    3⤵
    PID:7212
  - - C:\Windows\SysWOW64\ayPATPAT1023.exe
      C:\Windows\system32\ayPATPAT1023.exe
      4⤵
      PID:10008
    - - C:\Windows\SysWOW64\ayPATPAT1023.exe
        
        C:\Windows\system32\ayPATPAT1023.exe
        5⤵
        
        PID:7528
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\e7dda737da15240642953.bat
        5⤵
        
        PID:9952
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        6⤵
        
        PID:11328
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\e7dda737da15240642843.bat
      4⤵
      PID:9584
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        5⤵
        
        PID:11704
  - - C:\Windows\SysWOW64\ayPATPAT1023.exe
      C:\Windows\system32\ayPATPAT1023.exe
      4⤵
      PID:6388
    - - C:\Windows\SysWOW64\ayPATPAT1023.exe
        
        C:\Windows\system32\ayPATPAT1023.exe
        5⤵
        
        PID:8204
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\e7dda737da15240639234.bat
        5⤵
        
        PID:8196
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        6⤵
        
        PID:11464
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\e7dda737da15240642515.bat
      4⤵
      PID:9884
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
        5⤵
        
        PID:9480
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\e7dda737da15240642796.bat
    3⤵
    PID:9808
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\e7dda737da15240642750.bat
  2⤵
  PID:9880

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:9248

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:9232

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:9224

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:8900

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:8248
- C:\Windows\SysWOW64\ayPATPAT1023.exe
  C:\Windows\system32\ayPATPAT1023.exe
  2⤵
  PID:6796
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\e7dda737da15240643171.bat
  2⤵
  PID:8296
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:7628

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:9052

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
PID:9436
- C:\Windows\SysWOW64\ayPATPAT1023.exe
  C:\Windows\system32\ayPATPAT1023.exe
  2⤵
  PID:9608
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\e7dda737da15240642296.bat
  2⤵
  PID:8964
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:10828

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240642187.bat
1⤵
PID:7656
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:10908
- C:\Windows\SysWOW64\ayPATPAT1023.exe
  C:\Windows\system32\ayPATPAT1023.exe
  2⤵
  PID:7740
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\e7dda737da15240638218.bat
  2⤵
  PID:7732
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:9624

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:9752

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:7316

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240642375.bat
1⤵
PID:6592
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:11080
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:11076

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
PID:9780
- C:\Windows\SysWOW64\ayPATPAT1023.exe
  C:\Windows\system32\ayPATPAT1023.exe
  2⤵
  PID:7212
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\e7dda737da15240642437.bat
  2⤵
  PID:9576
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:9384

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:10128

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:10044

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:10172

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:8312

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:9756

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:9856

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
PID:10512
- C:\Windows\SysWOW64\ayPATPAT1023.exe
  C:\Windows\system32\ayPATPAT1023.exe
  2⤵
  PID:10604
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\e7dda737da15240643468.bat
  2⤵
  PID:10588
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:11776

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:10880

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:10952

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:11160

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:10284

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
PID:11012
- C:\Windows\SysWOW64\ayPATPAT1023.exe
  C:\Windows\system32\ayPATPAT1023.exe
  2⤵
  PID:7988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\e7dda737da15240643968.bat
  2⤵
  PID:11212
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:11284

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:9048

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:8880

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:10064
- C:\Windows\SysWOW64\ayPATPAT1023.exe
  C:\Windows\system32\ayPATPAT1023.exe
  2⤵
  PID:11828
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\e7dda737da15240647734.bat
  2⤵
  PID:10716

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:9968

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:10280

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:10776

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:9956

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:10752

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:9724

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:7672

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240643906.bat
1⤵
PID:7120
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:10264

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:10988

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:10876

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:9992

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
PID:9944
- C:\Windows\SysWOW64\ayPATPAT1023.exe
  C:\Windows\system32\ayPATPAT1023.exe
  2⤵
  PID:11228
- - C:\Windows\SysWOW64\ayPATPAT1023.exe
    C:\Windows\system32\ayPATPAT1023.exe
    3⤵
    PID:10716
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\e7dda737da15240644296.bat
    3⤵
    PID:10384
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\e7dda737da15240644093.bat
  2⤵
  PID:3580
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:8992

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240643796.bat
1⤵
PID:8852
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\e7dda737da15240643328.bat
  2⤵
  PID:10296
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:9964

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
PID:10196

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240643734.bat
1⤵
PID:9840

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:4540

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:11060

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:11000

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:10984

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:10992

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:10944

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:10936

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:11020

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:10272

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:10968

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:11080

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:11068

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:10112

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:10580

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
PID:10892

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:10752

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:10744

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:10704

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240643484.bat
1⤵
PID:10736
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  - Views/modifies file attributes
  PID:11552

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:10640

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:10684

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:10664

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:10612

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:10596

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:10540

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240643437.bat
1⤵
PID:10504
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  - Views/modifies file attributes
  PID:11928

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:10380

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:10340

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:10304

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:10268

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:10248

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:8496

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:9384

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
PID:8852

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240643312.bat
1⤵
PID:9628

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:9464

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:9452

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:10132

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:9872

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
PID:10104

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240643250.bat
1⤵
PID:7004

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:8328

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:9964

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
- Drops file in System32 directory
PID:8308

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:9688
- C:\Windows\SysWOW64\ayPATPAT1023.exe
  C:\Windows\system32\ayPATPAT1023.exe
  2⤵
  PID:9412
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\e7dda737da15240641984.bat
  2⤵
  PID:9800

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:8852
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:11044

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:9012

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:8808

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:8556

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:8432

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:9224

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:9496

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:9048

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:9944

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:6580

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
PID:7392

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240642546.bat
1⤵
PID:9960

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:10108

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
- Drops file in System32 directory
PID:9840
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:11512

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240642406.bat
1⤵
PID:9748

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
PID:9376

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:9412
- C:\Windows\SysWOW64\ayPATPAT1023.exe
  C:\Windows\system32\ayPATPAT1023.exe
  2⤵
  PID:10196
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\e7dda737da15240642031.bat
  2⤵
  PID:10216
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:2768

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:9628
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:11904

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:9692

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:7388

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:10072

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:9324

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:7908

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:9096

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:6992

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:8968

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:7800

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:6652

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:7528

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:8536

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:8036

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:4540

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:8820

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:8132

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:8048

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:8180

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:9160

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:9164

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:5908

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:8256

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
- Drops file in System32 directory
PID:8148

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:7044

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
- Drops file in System32 directory
PID:8124

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:220

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:7864
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\e7dda737da15240638375.bat
  2⤵
  PID:8008
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:11392

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:7756

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:6656

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:6968

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:7196

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:7532

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:6592

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
PID:6588

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240638859.bat
1⤵
PID:7540
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:10408

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:7564

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:6916

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240638750.bat
1⤵
PID:6940
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:11068

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:7836

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
PID:5956

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240638640.bat
1⤵
PID:6480
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:10132

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
PID:7560

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:7372

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:7072
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\e7dda737da15240637046.bat
  2⤵
  PID:7128
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    - Views/modifies file attributes
    PID:8920

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
PID:7220

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240638515.bat
1⤵
PID:5572

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:6088

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:5908
- C:\Windows\SysWOW64\ayPATPAT1023.exe
  C:\Windows\system32\ayPATPAT1023.exe
  2⤵
  PID:7092
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\e7dda737da15240637859.bat
  2⤵
  PID:6780
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:11108

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:8136

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:8128

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:8096

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:8036

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:7980

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:7952

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
PID:7864

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240638265.bat
1⤵
PID:7848
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:12180

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
- Drops file in System32 directory
PID:7796

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:7756

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
PID:7656

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:7596

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:7500

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240638093.bat
1⤵
PID:7448
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:9504

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:7428

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
- Drops file in System32 directory
PID:7332

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240638046.bat
1⤵
PID:7324

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
- Drops file in System32 directory
PID:7272

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:7248

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:7196

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
PID:7176

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240637953.bat
1⤵
PID:5676

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:6804

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:6616

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
PID:7080

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240637890.bat
1⤵
PID:6036
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:11140

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:6584
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\e7dda737da15240637359.bat
  2⤵
  PID:6860
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:7988

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
PID:5908

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240637765.bat
1⤵
PID:6160
- C:\Windows\SysWOW64\ayPATPAT1023.exe
  C:\Windows\system32\ayPATPAT1023.exe
  2⤵
  PID:6636

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:6916

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:6804

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:6836
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\e7dda737da15240636953.bat
  2⤵
  PID:6952
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:11304

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:6464

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:6580

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
- Executes dropped EXE
PID:5652

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:6032
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:11384

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:6084

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:5196

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:5676

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:6200

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:6980

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:5900

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:5736

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:6692
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:8888

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240637281.bat
1⤵
PID:6448
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  - Drops file in System32 directory
  PID:11320

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:4416

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:5572
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:10784

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
PID:6420

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240637218.bat
1⤵
- Executes dropped EXE
PID:6300
- C:\Windows\SysWOW64\ayPATPAT1023.exe
  C:\Windows\system32\ayPATPAT1023.exe
  2⤵
  - Executes dropped EXE
  PID:6436
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\e7dda737da15240636656.bat
  2⤵
  PID:6428
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:11336
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:11280

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:6064

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:7108

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:7092

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
- Drops file in System32 directory
PID:7080

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:6912

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:6904

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:6884

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:6744

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:6708

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
PID:6688

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240636781.bat
1⤵
PID:6660

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
- Executes dropped EXE
PID:6560

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240636718.bat
1⤵
PID:6548
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:10808

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
- Drops file in System32 directory
PID:6492

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:6308

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240636562.bat
1⤵
PID:6292
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:11344

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:6196

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:5676

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Executes dropped EXE
PID:5192
- C:\Windows\SysWOW64\ayPATPAT1023.exe
  C:\Windows\system32\ayPATPAT1023.exe
  2⤵
  - Executes dropped EXE
  PID:5244
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:11312
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\e7dda737da15240635281.bat
  2⤵
  PID:5236

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240636343.bat
1⤵
PID:5928
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:10640

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:5124

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
- Executes dropped EXE
PID:5692

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240636312.bat
1⤵
PID:5932
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:11036

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:6000

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:5172
- C:\Windows\SysWOW64\ayPATPAT1023.exe
  C:\Windows\system32\ayPATPAT1023.exe
  2⤵
  - Executes dropped EXE
  PID:5156
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\e7dda737da15240635906.bat
  2⤵
  PID:5256
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:7800

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:5404

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:5832

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:5348

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
- Executes dropped EXE
PID:5620

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240635984.bat
1⤵
PID:5276

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:3664

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:5428

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:5176

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240635781.bat
1⤵
PID:6048
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:11484

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:6004

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
- Executes dropped EXE
PID:5992

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:5732

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:5712

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:5704

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:5696

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
- Executes dropped EXE
PID:5452

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240635406.bat
1⤵
PID:5444
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:10532

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
- Executes dropped EXE
PID:5400

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240635375.bat
1⤵
PID:5392
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:8496

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Executes dropped EXE
PID:4592

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1628
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:9000

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240635187.bat
1⤵
PID:3460
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:11668

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240635078.bat
1⤵
PID:548

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:4408
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:11088

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:4524

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:572

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:3716

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240634593.bat
1⤵
PID:1724
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:10676

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:4104

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:4652

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
- Executes dropped EXE
PID:3728
- C:\Windows\SysWOW64\ayPATPAT1023.exe
  C:\Windows\system32\ayPATPAT1023.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\e7dda737da15240633546.bat
  2⤵
  PID:3504

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240634250.bat
1⤵
PID:2964

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:572

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:2968

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:4100

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
- Executes dropped EXE
PID:2704
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\e7dda737da15240633500.bat
  2⤵
  PID:1840
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:11272

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
- Executes dropped EXE
PID:4832

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
- Executes dropped EXE
PID:3424

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:644

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
- Executes dropped EXE
PID:4920

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240633640.bat
1⤵
PID:3492

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240633562.bat
1⤵
PID:3480
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:9624

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:3396

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
1⤵
PID:4160

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240633453.bat
1⤵
PID:3432

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240633437.bat
1⤵
PID:4336

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240633296.bat
1⤵
PID:528
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
  2⤵
  PID:11424

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240633265.bat
1⤵
PID:1496

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
PID:11704
- C:\Windows\SysWOW64\ayPATPAT1023.exe
  C:\Windows\system32\ayPATPAT1023.exe
  2⤵
  PID:11900
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\e7dda737da15240646265.bat
  2⤵
  PID:11884
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\ayPATPAT1023.exe" -r -a -s -h
    3⤵
    PID:10796

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
PID:10048

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240646359.bat
1⤵
PID:10652

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\e7dda737da15240646203.bat
1⤵
PID:11692

C:\Windows\SysWOW64\ayPATPAT1023.exe
C:\Windows\system32\ayPATPAT1023.exe
1⤵
PID:10584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\ayPATPAT1023.exe

Filesize
13KB

MD5
03cc81994173a2270d4a42ec620fc289

SHA1
72be100d2b5589adbb54c1691735ff0ee7e5a25d

SHA256
be0234f8efdde6a2dfe06308b04e824125a23ae2ec0c9e42630088660ca61ca0

SHA512
d515d5aa8d4165a7bfb58f1171c0c273228cb54fcc743d519c4ed9e88cc4af27e1179b833ca38802bb67a63663c3c1863f593bf13c287a301116a9214ee36bc3

Download Submit
C:\e7dda737da15240633031.bat

Filesize
290B

MD5
fa5438af00f57f206850051402811e51

SHA1
ca4016523ed50ff764722fa2e4f14b8a13334efe

SHA256
c93c7bd473b59d558164e48cc6478213f9a609baff507bce897eff0df411d409

SHA512
c57f06d545ecc827b16c69897b4dbf28c42bde65ba57f927874e36da4c222bca4dc25a405ef843c264703d233b0828e6f1859ad1b835323aae2e1754996582c1

Download Submit
C:\e7dda737da15240633296.bat

Filesize
188B

MD5
6f67733fd9dd249b0f2793f147ad9194

SHA1
493dd3137c2e341333219faa6b99c41e04531ad1

SHA256
e8616018aab84d8473f44d8454c60c7acb4e2f48bc8afaee1eb36a4aa34b9e06

SHA512
bfbffd0eecacdf4eae513e5b7581f27acaf70750c1710c8f191749bcc31a03c8be0678db277ce258eb879896f0e261709387b4659d242bce0add53a4059b3105

Download Submit