1dc110292c7ba4cb4a309579c0c502cb05c86e04973e7e7652676cc21c6f3f89

Analysis

max time kernel
2s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
16/02/2024, 01:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9f257b8fbb88e67d6cdfdc36fd8ba11a.exe
Size 14KB
Sample240216-ccq2xsfa94
SHA256 1dc110292c7ba4cb4a309579c0c502cb05c86e04973e7e7652676cc21c6f3f89
MD5 9f257b8fbb88e67d6cdfdc36fd8ba11a
SHA1 abf1c8a1d9a0e1febfc670f76177843e015d590d
SHA512 87fab3016647d45aa08474b0eccbe7bb4cbe5373a696d7358592ab33785031178714d98174c66190a0578248fadc330b3d9dabc13f3b86bdcc23f964b3de6e5e
SSDEEP 384:IQp76MjlsBTctIEZ4xqALsdRuZpMPd13j2raL3gn:4qsB1k4ISIE70vjGa4
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

adware persistence stealer

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Executes dropped EXE 7 IoCs

pid	Process
1068	posqatyu.exe
7588	posqatyu.exe
1488	posqatyu.exe
624	posqatyu.exe
10316	posqatyu.exe
7292	posqatyu.exe
8108	posqatyu.exe

Installs/modifies Browser Helper Object 2 TTPs 14 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18093456-9012-4568-9076-908765467181}\ = "tisqatyu.dll"	posqatyu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18093456-9012-4568-9076-908765467181}	posqatyu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18093456-9012-4568-9076-908765467181}\ = "tisqatyu.dll"	posqatyu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18093456-9012-4568-9076-908765467181}\ = "tisqatyu.dll"	posqatyu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18093456-9012-4568-9076-908765467181}\ = "tisqatyu.dll"	posqatyu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18093456-9012-4568-9076-908765467181}	posqatyu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18093456-9012-4568-9076-908765467181}	posqatyu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18093456-9012-4568-9076-908765467181}\ = "tisqatyu.dll"	9f257b8fbb88e67d6cdfdc36fd8ba11a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18093456-9012-4568-9076-908765467181}	posqatyu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18093456-9012-4568-9076-908765467181}\ = "tisqatyu.dll"	posqatyu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18093456-9012-4568-9076-908765467181}\ = "tisqatyu.dll"	posqatyu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18093456-9012-4568-9076-908765467181}	posqatyu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18093456-9012-4568-9076-908765467181}	posqatyu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18093456-9012-4568-9076-908765467181}	9f257b8fbb88e67d6cdfdc36fd8ba11a.exe

Drops file in System32 directory 39 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\tisqatyu.dll	posqatyu.exe
File opened for modification	C:\Windows\SysWOW64\posqatyu.exe	posqatyu.exe
File opened for modification	C:\Windows\SysWOW64\tisqatyu.dll	posqatyu.exe
File created	C:\Windows\SysWOW64\posqatyu.exe	9f257b8fbb88e67d6cdfdc36fd8ba11a.exe
File opened for modification	C:\Windows\SysWOW64\tisqatyu.dll	posqatyu.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	posqatyu.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	posqatyu.exe
File created	C:\Windows\SysWOW64\tisqatyu.dll	posqatyu.exe
File opened for modification	C:\Windows\SysWOW64\posqatyu.exe	posqatyu.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	posqatyu.exe
File opened for modification	C:\Windows\SysWOW64\tisqatyu.dll	posqatyu.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	posqatyu.exe
File opened for modification	C:\Windows\SysWOW64\tisqatyu.dll	posqatyu.exe
File opened for modification	C:\Windows\SysWOW64\cgsqatyu.sys	posqatyu.exe
File opened for modification	C:\Windows\SysWOW64\cgsqatyu.sys	posqatyu.exe
File opened for modification	C:\Windows\SysWOW64\cgsqatyu.sys	posqatyu.exe
File opened for modification	C:\Windows\SysWOW64\tisqatyu.dll	9f257b8fbb88e67d6cdfdc36fd8ba11a.exe
File opened for modification	C:\Windows\SysWOW64\tisqatyu.dll	posqatyu.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	posqatyu.exe
File created	C:\Windows\SysWOW64\tisqatyu.dll	posqatyu.exe
File opened for modification	C:\Windows\SysWOW64\posqatyu.exe	posqatyu.exe
File created	C:\Windows\SysWOW64\tisqatyu.dll	posqatyu.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	posqatyu.exe
File created	C:\Windows\SysWOW64\tisqatyu.dll	posqatyu.exe
File opened for modification	C:\Windows\SysWOW64\cgsqatyu.sys	posqatyu.exe
File created	C:\Windows\SysWOW64\tisqatyu.dll	posqatyu.exe
File opened for modification	C:\Windows\SysWOW64\tisqatyu.dll	posqatyu.exe
File opened for modification	C:\Windows\SysWOW64\cgsqatyu.sys	posqatyu.exe
File opened for modification	C:\Windows\SysWOW64\posqatyu.exe	9f257b8fbb88e67d6cdfdc36fd8ba11a.exe
File opened for modification	C:\Windows\SysWOW64\posqatyu.exe	posqatyu.exe
File opened for modification	C:\Windows\SysWOW64\tisqatyu.dll	posqatyu.exe
File created	C:\Windows\SysWOW64\tisqatyu.dll	posqatyu.exe
File opened for modification	C:\Windows\SysWOW64\posqatyu.exe	posqatyu.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	posqatyu.exe
File opened for modification	C:\Windows\SysWOW64\posqatyu.exe	posqatyu.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	9f257b8fbb88e67d6cdfdc36fd8ba11a.exe
File created	C:\Windows\SysWOW64\tisqatyu.dll	9f257b8fbb88e67d6cdfdc36fd8ba11a.exe
File opened for modification	C:\Windows\SysWOW64\cgsqatyu.sys	posqatyu.exe
File opened for modification	C:\Windows\SysWOW64\cgsqatyu.sys	9f257b8fbb88e67d6cdfdc36fd8ba11a.exe

Modifies registry class 24 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18093456-9012-4568-9076-908765467181}\InprocServer32\ThreadingModel = "Apartment"	posqatyu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18093456-9012-4568-9076-908765467181}\InprocServer32	posqatyu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18093456-9012-4568-9076-908765467181}\InprocServer32	posqatyu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18093456-9012-4568-9076-908765467181}\InprocServer32\ = "C:\\Windows\\SysWow64\\tisqatyu.dll"	9f257b8fbb88e67d6cdfdc36fd8ba11a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18093456-9012-4568-9076-908765467181}\InprocServer32\ThreadingModel = "Apartment"	9f257b8fbb88e67d6cdfdc36fd8ba11a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18093456-9012-4568-9076-908765467181}\InprocServer32\ = "C:\\Windows\\SysWow64\\tisqatyu.dll"	posqatyu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18093456-9012-4568-9076-908765467181}\InprocServer32\ThreadingModel = "Apartment"	posqatyu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18093456-9012-4568-9076-908765467181}\InprocServer32	posqatyu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18093456-9012-4568-9076-908765467181}\InprocServer32\ = "C:\\Windows\\SysWow64\\tisqatyu.dll"	posqatyu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18093456-9012-4568-9076-908765467181}\InprocServer32\ThreadingModel = "Apartment"	posqatyu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18093456-9012-4568-9076-908765467181}\InprocServer32\ThreadingModel = "Apartment"	posqatyu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18093456-9012-4568-9076-908765467181}\InprocServer32	9f257b8fbb88e67d6cdfdc36fd8ba11a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18093456-9012-4568-9076-908765467181}\InprocServer32	posqatyu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18093456-9012-4568-9076-908765467181}\InprocServer32\ = "C:\\Windows\\SysWow64\\tisqatyu.dll"	posqatyu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18093456-9012-4568-9076-908765467181}\InprocServer32	posqatyu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18093456-9012-4568-9076-908765467181}\InprocServer32\ = "C:\\Windows\\SysWow64\\tisqatyu.dll"	posqatyu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18093456-9012-4568-9076-908765467181}	9f257b8fbb88e67d6cdfdc36fd8ba11a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18093456-9012-4568-9076-908765467181}\InprocServer32\ = "C:\\Windows\\SysWow64\\tisqatyu.dll"	posqatyu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18093456-9012-4568-9076-908765467181}\InprocServer32\ThreadingModel = "Apartment"	posqatyu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18093456-9012-4568-9076-908765467181}\InprocServer32\ = "C:\\Windows\\SysWow64\\tisqatyu.dll"	posqatyu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	9f257b8fbb88e67d6cdfdc36fd8ba11a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	9f257b8fbb88e67d6cdfdc36fd8ba11a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18093456-9012-4568-9076-908765467181}\InprocServer32	posqatyu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18093456-9012-4568-9076-908765467181}\InprocServer32\ThreadingModel = "Apartment"	posqatyu.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1892	9f257b8fbb88e67d6cdfdc36fd8ba11a.exe
1892	9f257b8fbb88e67d6cdfdc36fd8ba11a.exe
1068	posqatyu.exe
1068	posqatyu.exe
7588	posqatyu.exe
7588	posqatyu.exe
1488	posqatyu.exe
1488	posqatyu.exe
624	posqatyu.exe
624	posqatyu.exe
10316	posqatyu.exe
10316	posqatyu.exe
7292	posqatyu.exe
7292	posqatyu.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	1892	9f257b8fbb88e67d6cdfdc36fd8ba11a.exe
Token: SeDebugPrivilege	1068	posqatyu.exe
Token: SeDebugPrivilege	7588	posqatyu.exe
Token: SeDebugPrivilege	1488	posqatyu.exe
Token: SeDebugPrivilege	624	posqatyu.exe
Token: SeDebugPrivilege	10316	posqatyu.exe
Token: SeDebugPrivilege	7292	posqatyu.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 2176	1892	9f257b8fbb88e67d6cdfdc36fd8ba11a.exe	86
PID 1892 wrote to memory of 2176	1892	9f257b8fbb88e67d6cdfdc36fd8ba11a.exe	86
PID 1892 wrote to memory of 2176	1892	9f257b8fbb88e67d6cdfdc36fd8ba11a.exe	86
PID 1892 wrote to memory of 1068	1892	9f257b8fbb88e67d6cdfdc36fd8ba11a.exe	118
PID 1892 wrote to memory of 1068	1892	9f257b8fbb88e67d6cdfdc36fd8ba11a.exe	118
PID 1892 wrote to memory of 1068	1892	9f257b8fbb88e67d6cdfdc36fd8ba11a.exe	118
PID 1068 wrote to memory of 4616	1068	posqatyu.exe	88
PID 1068 wrote to memory of 4616	1068	posqatyu.exe	88
PID 1068 wrote to memory of 4616	1068	posqatyu.exe	88
PID 1068 wrote to memory of 7588	1068	posqatyu.exe	90
PID 1068 wrote to memory of 7588	1068	posqatyu.exe	90
PID 1068 wrote to memory of 7588	1068	posqatyu.exe	90
PID 7588 wrote to memory of 7616	7588	posqatyu.exe	91
PID 7588 wrote to memory of 7616	7588	posqatyu.exe	91
PID 7588 wrote to memory of 7616	7588	posqatyu.exe	91
PID 7588 wrote to memory of 1488	7588	posqatyu.exe	92
PID 7588 wrote to memory of 1488	7588	posqatyu.exe	92
PID 7588 wrote to memory of 1488	7588	posqatyu.exe	92
PID 1488 wrote to memory of 5480	1488	posqatyu.exe	93
PID 1488 wrote to memory of 5480	1488	posqatyu.exe	93
PID 1488 wrote to memory of 5480	1488	posqatyu.exe	93
PID 1488 wrote to memory of 624	1488	posqatyu.exe	95
PID 1488 wrote to memory of 624	1488	posqatyu.exe	95
PID 1488 wrote to memory of 624	1488	posqatyu.exe	95
PID 624 wrote to memory of 5260	624	posqatyu.exe	96
PID 624 wrote to memory of 5260	624	posqatyu.exe	96
PID 624 wrote to memory of 5260	624	posqatyu.exe	96
PID 624 wrote to memory of 10316	624	posqatyu.exe	97
PID 624 wrote to memory of 10316	624	posqatyu.exe	97
PID 624 wrote to memory of 10316	624	posqatyu.exe	97
PID 10316 wrote to memory of 10356	10316	posqatyu.exe	111
PID 10316 wrote to memory of 10356	10316	posqatyu.exe	111
PID 10316 wrote to memory of 10356	10316	posqatyu.exe	111
PID 10316 wrote to memory of 7292	10316	posqatyu.exe	99
PID 10316 wrote to memory of 7292	10316	posqatyu.exe	99
PID 10316 wrote to memory of 7292	10316	posqatyu.exe	99
PID 7292 wrote to memory of 7344	7292	posqatyu.exe	110
PID 7292 wrote to memory of 7344	7292	posqatyu.exe	110
PID 7292 wrote to memory of 7344	7292	posqatyu.exe	110
PID 7292 wrote to memory of 8108	7292	posqatyu.exe	109
PID 7292 wrote to memory of 8108	7292	posqatyu.exe	109
PID 7292 wrote to memory of 8108	7292	posqatyu.exe	109
PID 8108 wrote to memory of 8056	8108	posqatyu.exe	108
PID 8108 wrote to memory of 8056	8108	posqatyu.exe	108
PID 8108 wrote to memory of 8056	8108	posqatyu.exe	108

C:\Users\Admin\AppData\Local\Temp\9f257b8fbb88e67d6cdfdc36fd8ba11a.exe
"C:\Users\Admin\AppData\Local\Temp\9f257b8fbb88e67d6cdfdc36fd8ba11a.exe"
1⤵
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240598687.bat
  2⤵
  PID:2176
- C:\Windows\SysWOW64\posqatyu.exe
  C:\Windows\system32\posqatyu.exe
  2⤵
  - Executes dropped EXE
  - Installs/modifies Browser Helper Object
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1068
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240630078.bat
    3⤵
    PID:10700
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240629906.bat
  2⤵
  PID:10476

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240599046.bat
1⤵
PID:4616

C:\Windows\SysWOW64\posqatyu.exe
C:\Windows\system32\posqatyu.exe
1⤵
- Executes dropped EXE
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:7588
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240599359.bat
  2⤵
  PID:7616
- C:\Windows\SysWOW64\posqatyu.exe
  C:\Windows\system32\posqatyu.exe
  2⤵
  - Executes dropped EXE
  - Installs/modifies Browser Helper Object
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1488
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240599671.bat
    3⤵
    PID:5480
- - C:\Windows\SysWOW64\posqatyu.exe
    C:\Windows\system32\posqatyu.exe
    3⤵
    - Executes dropped EXE
    - Installs/modifies Browser Helper Object
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:624
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240599968.bat
      4⤵
      PID:5260
  - - C:\Windows\SysWOW64\posqatyu.exe
      C:\Windows\system32\posqatyu.exe
      4⤵
      Executes dropped EXE
      Installs/modifies Browser Helper Object
      Drops file in System32 directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:10316
    - - C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        5⤵
        Executes dropped EXE
        Installs/modifies Browser Helper Object
        Drops file in System32 directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:7292
      - C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:8108
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240631718.bat
        7⤵
        
        PID:6400
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240600531.bat
        6⤵
        
        PID:7344
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240631687.bat
        6⤵
        
        PID:12964
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240600250.bat
        5⤵
        
        PID:10356
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240631328.bat
        5⤵
        
        PID:12644
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240630796.bat
      4⤵
      PID:13336
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240630437.bat
    3⤵
    PID:10468
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240630203.bat
  2⤵
  PID:10408

C:\Windows\SysWOW64\posqatyu.exe
C:\Windows\system32\posqatyu.exe
1⤵
PID:7036
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240601593.bat
  2⤵
  PID:5972
- C:\Windows\SysWOW64\posqatyu.exe
  C:\Windows\system32\posqatyu.exe
  2⤵
  PID:9440
- - C:\Windows\SysWOW64\posqatyu.exe
    C:\Windows\system32\posqatyu.exe
    3⤵
    PID:2368
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240602296.bat
      4⤵
      PID:1392
  - - C:\Windows\SysWOW64\posqatyu.exe
      C:\Windows\system32\posqatyu.exe
      4⤵
      PID:6864
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240602609.bat
        5⤵
        
        PID:6828
    - - C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        5⤵
        
        PID:5416
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240602937.bat
        6⤵
        
        PID:5448
      - C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        6⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240603187.bat
        7⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        7⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240604046.bat
        8⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        8⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        9⤵
        
        PID:10792
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240605484.bat
        10⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        10⤵
        
        PID:4972
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240605906.bat
        11⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        11⤵
        
        PID:7180
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240606234.bat
        12⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        12⤵
        
        PID:9256
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240606656.bat
        13⤵
        
        PID:9104
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        13⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240607078.bat
        14⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        14⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240607515.bat
        15⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        15⤵
        
        PID:1936
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240607843.bat
        16⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        16⤵
        
        PID:10640
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240608265.bat
        17⤵
        
        PID:10940
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        17⤵
        
        PID:10924
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240608640.bat
        18⤵
        
        PID:11220
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        18⤵
        
        PID:3620
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240609093.bat
        19⤵
        
        PID:2124
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        19⤵
        
        PID:7816
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240609468.bat
        20⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        20⤵
        
        PID:10072
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240609890.bat
        21⤵
        
        PID:9500
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        21⤵
        
        PID:8504
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240610218.bat
        22⤵
        
        PID:2488
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        22⤵
        
        PID:9136
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240610625.bat
        23⤵
        
        PID:3208
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        23⤵
        
        PID:9888
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240611140.bat
        24⤵
        
        PID:8448
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        24⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240611593.bat
        25⤵
        
        PID:7852
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        25⤵
        
        PID:10748
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240612671.bat
        26⤵
        
        PID:8604
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        26⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240613000.bat
        27⤵
        
        PID:592
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        27⤵
        
        PID:2064
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240613390.bat
        28⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        28⤵
        
        PID:11564
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240613750.bat
        29⤵
        
        PID:11328
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        29⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240614125.bat
        30⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        30⤵
        
        PID:11756
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240614421.bat
        31⤵
        
        PID:11732
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        31⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240614921.bat
        32⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        32⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240615140.bat
        33⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        33⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240615500.bat
        34⤵
        
        PID:3096
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        34⤵
        
        PID:10888
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240615859.bat
        35⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        35⤵
        
        PID:800
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240616203.bat
        36⤵
        
        PID:1144
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        36⤵
        
        PID:13164
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240616531.bat
        37⤵
        
        PID:12952
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        37⤵
        
        PID:10824
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240616968.bat
        38⤵
        
        PID:4912
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        38⤵
        
        PID:9576
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240617343.bat
        39⤵
        
        PID:8492
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        39⤵
        
        PID:4904
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240617703.bat
        40⤵
        
        PID:11276
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        40⤵
        
        PID:5060
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240618109.bat
        41⤵
        
        PID:10988
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        41⤵
        
        PID:11372
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240618500.bat
        42⤵
        
        PID:11828
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        42⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240618968.bat
        43⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        43⤵
        
        PID:12128
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240619312.bat
        44⤵
        
        PID:12176
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        44⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        45⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240619984.bat
        46⤵
        
        PID:9332
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        46⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240620328.bat
        47⤵
        
        PID:11000
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        47⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240620828.bat
        48⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        48⤵
        
        PID:9728
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240621218.bat
        49⤵
        
        PID:1836
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        49⤵
        
        PID:2372
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240621453.bat
        50⤵
        
        PID:10972
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        50⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240621796.bat
        51⤵
        
        PID:8224
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        51⤵
        
        PID:4172
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240622171.bat
        52⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        52⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240622515.bat
        53⤵
        
        PID:2484
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        53⤵
        
        PID:3044
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        54⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240623156.bat
        55⤵
        
        PID:13004
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        55⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240623375.bat
        56⤵
        
        PID:12740
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        56⤵
        
        PID:10176
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240623671.bat
        57⤵
        
        PID:1656
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        57⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240624218.bat
        58⤵
        
        PID:12196
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        58⤵
        
        PID:4376
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240624484.bat
        59⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        59⤵
        
        PID:9928
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240624781.bat
        60⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        60⤵
        
        PID:10796
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240625156.bat
        61⤵
        
        PID:1520
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        61⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240625468.bat
        62⤵
        
        PID:8736
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        62⤵
        
        PID:9748
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240625718.bat
        63⤵
        
        PID:3788
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        63⤵
        
        PID:9744
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240626031.bat
        64⤵
        
        PID:4620
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        64⤵
        
        PID:9960
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240626468.bat
        65⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        65⤵
        
        PID:12528
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240626843.bat
        66⤵
        
        PID:13120
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        66⤵
        
        PID:10040
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240627234.bat
        67⤵
        
        PID:13200
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        67⤵
        
        PID:12324
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240627656.bat
        68⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        68⤵
        
        PID:2188
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240627906.bat
        69⤵
        
        PID:9368
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        69⤵
        
        PID:14712
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240628171.bat
        70⤵
        
        PID:14668
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        70⤵
        
        PID:11688
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240628609.bat
        71⤵
        
        PID:10532
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        71⤵
        
        PID:4988
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        72⤵
        
        PID:13964
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240629515.bat
        73⤵
        
        PID:8500
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        73⤵
        
        PID:12824
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240629812.bat
        74⤵
        
        PID:10448
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        74⤵
        
        PID:10856
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240630406.bat
        75⤵
        
        PID:13028
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        75⤵
        
        PID:13612
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240664531.bat
        75⤵
        
        PID:17436
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240660390.bat
        73⤵
        
        PID:17236
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240629093.bat
        72⤵
        
        PID:11848
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240660125.bat
        72⤵
        
        PID:17608
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240659828.bat
        71⤵
        
        PID:16080
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240659171.bat
        70⤵
        
        PID:10888
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240658718.bat
        69⤵
        
        PID:7864
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240658468.bat
        68⤵
        
        PID:16968
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240658234.bat
        67⤵
        
        PID:2000
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240657812.bat
        66⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240657421.bat
        65⤵
        
        PID:13560
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240657125.bat
        64⤵
        
        PID:12624
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240656531.bat
        63⤵
        
        PID:9224
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240656421.bat
        62⤵
        
        PID:2136
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240656015.bat
        61⤵
        
        PID:8052
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240655828.bat
        60⤵
        
        PID:16068
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240655265.bat
        59⤵
        
        PID:13864
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240655203.bat
        58⤵
        
        PID:15416
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240654734.bat
        57⤵
        
        PID:15604
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240654203.bat
        56⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240654109.bat
        55⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240653937.bat
        54⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240653359.bat
        53⤵
        
        PID:12256
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240653296.bat
        52⤵
        
        PID:15252
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240652875.bat
        51⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240652390.bat
        50⤵
        
        PID:11360
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240652109.bat
        49⤵
        
        PID:14016
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240651750.bat
        48⤵
        
        PID:14480
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240651609.bat
        47⤵
        
        PID:15712
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240651218.bat
        46⤵
        
        PID:16020
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240650765.bat
        45⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240650437.bat
        44⤵
        
        PID:16264
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240650156.bat
        43⤵
        
        PID:11500
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240649593.bat
        42⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240649187.bat
        41⤵
        
        PID:13884
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240648703.bat
        40⤵
        
        PID:4488
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240648281.bat
        39⤵
        
        PID:15232
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240647921.bat
        38⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240647921.bat
        37⤵
        
        PID:12360
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240647828.bat
        36⤵
        
        PID:12400
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240647437.bat
        35⤵
        
        PID:14532
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240647343.bat
        34⤵
        
        PID:16204
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240646187.bat
        33⤵
        
        PID:16152
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240645796.bat
        32⤵
        
        PID:14760
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240645578.bat
        31⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240644906.bat
        30⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240644734.bat
        29⤵
        
        PID:15168
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240644375.bat
        28⤵
        
        PID:540
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240656031.bat
        28⤵
        
        PID:4460
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240644187.bat
        27⤵
        
        PID:10352
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240643765.bat
        26⤵
        
        PID:11452
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240642484.bat
        25⤵
        
        PID:14184
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240642296.bat
        24⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240641750.bat
        23⤵
        
        PID:13448
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240641312.bat
        22⤵
        
        PID:12276
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240640937.bat
        21⤵
        
        PID:12044
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240640531.bat
        20⤵
        
        PID:10868
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240639984.bat
        19⤵
        
        PID:8524
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240639703.bat
        18⤵
        
        PID:10132
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240639171.bat
        17⤵
        
        PID:1568
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240638937.bat
        16⤵
        
        PID:9896
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240638421.bat
        15⤵
        
        PID:1840
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240638203.bat
        14⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240637703.bat
        13⤵
        
        PID:11640
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240637328.bat
        12⤵
        
        PID:13452
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240636921.bat
        11⤵
        
        PID:8956
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240636562.bat
        10⤵
        
        PID:392
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240605109.bat
        9⤵
        
        PID:5068
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240636156.bat
        9⤵
        
        PID:9096
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240635828.bat
        8⤵
        
        PID:14164
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240634609.bat
        7⤵
        
        PID:13536
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240633750.bat
        6⤵
        
        PID:2824
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240633468.bat
        5⤵
        
        PID:9364
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240633343.bat
      4⤵
      PID:2672
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240601968.bat
    3⤵
    PID:9676
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240632859.bat
    3⤵
    PID:13688
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240632562.bat
  2⤵
  PID:1068

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240601078.bat
1⤵
PID:8860

C:\Windows\SysWOW64\posqatyu.exe
C:\Windows\system32\posqatyu.exe
1⤵
PID:8812
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240632203.bat
  2⤵
  PID:9836

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240600812.bat
1⤵
PID:8056

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240619593.bat
1⤵
PID:6788

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240622828.bat
1⤵
PID:3136

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240630796.bat
1⤵
PID:5360

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240631187.bat
1⤵
PID:3880

C:\Windows\SysWOW64\posqatyu.exe
C:\Windows\system32\posqatyu.exe
1⤵
PID:12356
- C:\Windows\SysWOW64\posqatyu.exe
  C:\Windows\system32\posqatyu.exe
  2⤵
  PID:3564
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240631640.bat
    3⤵
    PID:4408
- - C:\Windows\SysWOW64\posqatyu.exe
    C:\Windows\system32\posqatyu.exe
    3⤵
    PID:10528
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240632171.bat
      4⤵
      PID:7028
  - - C:\Windows\SysWOW64\posqatyu.exe
      C:\Windows\system32\posqatyu.exe
      4⤵
      PID:5004
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240632578.bat
        5⤵
        
        PID:5800
    - - C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        5⤵
        
        PID:13700
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240665093.bat
        5⤵
        
        PID:7160
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240665000.bat
      4⤵
      PID:13112

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240632921.bat
1⤵
PID:13648

C:\Windows\SysWOW64\posqatyu.exe
C:\Windows\system32\posqatyu.exe
1⤵
PID:9192
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240633421.bat
  2⤵
  PID:13048
- C:\Windows\SysWOW64\posqatyu.exe
  C:\Windows\system32\posqatyu.exe
  2⤵
  PID:13480
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240633796.bat
    3⤵
    PID:10300
- - C:\Windows\SysWOW64\posqatyu.exe
    C:\Windows\system32\posqatyu.exe
    3⤵
    PID:10148
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240634250.bat
      4⤵
      PID:14348
  - - C:\Windows\SysWOW64\posqatyu.exe
      C:\Windows\system32\posqatyu.exe
      4⤵
      PID:6196
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240634687.bat
        5⤵
        
        PID:10996
    - - C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        5⤵
        
        PID:10212
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240635078.bat
        6⤵
        
        PID:12116
      - C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        6⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240635468.bat
        7⤵
        
        PID:13308
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        7⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240635750.bat
        8⤵
        
        PID:10520
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        8⤵
        
        PID:2324
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        9⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240636531.bat
        10⤵
        
        PID:4948
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        10⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240636937.bat
        11⤵
        
        PID:10144
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        11⤵
        
        PID:13724
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240637515.bat
        12⤵
        
        PID:14584
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        12⤵
        
        PID:14416
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240637968.bat
        13⤵
        
        PID:11844
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        13⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        14⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240638703.bat
        15⤵
        
        PID:15036
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        15⤵
        
        PID:7836
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240639109.bat
        16⤵
        
        PID:4476
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        16⤵
        
        PID:4800
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        17⤵
        
        PID:14300
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240640234.bat
        18⤵
        
        PID:10152
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        18⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240640625.bat
        19⤵
        
        PID:920
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        19⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        20⤵
        
        PID:5700
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240641531.bat
        21⤵
        
        PID:14340
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        21⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240641921.bat
        22⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        22⤵
        
        PID:14100
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240642265.bat
        23⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        23⤵
        
        PID:15148
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240642625.bat
        24⤵
        
        PID:14044
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        24⤵
        
        PID:4424
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240642953.bat
        25⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        25⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240643359.bat
        26⤵
        
        PID:11280
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        26⤵
        
        PID:11104
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240643906.bat
        27⤵
        
        PID:11496
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        27⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240644187.bat
        28⤵
        
        PID:2200
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        28⤵
        
        PID:9548
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240644593.bat
        29⤵
        
        PID:14536
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        29⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240644984.bat
        30⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        30⤵
        
        PID:13072
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240645296.bat
        31⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        31⤵
        
        PID:11592
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240645781.bat
        32⤵
        
        PID:12564
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        32⤵
        
        PID:13772
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240647359.bat
        33⤵
        
        PID:16252
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        33⤵
        
        PID:1560
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240647765.bat
        34⤵
        
        PID:14132
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        34⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240648328.bat
        35⤵
        
        PID:15104
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        35⤵
        
        PID:13588
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240648781.bat
        36⤵
        
        PID:10068
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        36⤵
        
        PID:15664
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240649234.bat
        37⤵
        
        PID:3092
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        37⤵
        
        PID:1012
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240649578.bat
        38⤵
        
        PID:12440
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        38⤵
        
        PID:13252
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240650015.bat
        39⤵
        
        PID:10108
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        39⤵
        
        PID:15868
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240650343.bat
        40⤵
        
        PID:15960
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        40⤵
        
        PID:14256
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240650812.bat
        41⤵
        
        PID:11944
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        41⤵
        
        PID:3032
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        42⤵
        
        PID:16120
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240651812.bat
        43⤵
        
        PID:11168
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        43⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240652421.bat
        44⤵
        
        PID:10656
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        44⤵
        
        PID:15536
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240652890.bat
        45⤵
        
        PID:15456
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        45⤵
        
        PID:15500
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        46⤵
        
        PID:8984
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240653765.bat
        47⤵
        
        PID:16472
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        47⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240654500.bat
        48⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        48⤵
        
        PID:15608
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        49⤵
        
        PID:10684
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        50⤵
        
        PID:8556
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240655640.bat
        51⤵
        
        PID:15964
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        51⤵
        
        PID:2064
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        52⤵
        
        PID:1344
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        53⤵
        
        PID:11096
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240656921.bat
        54⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        54⤵
        
        PID:14140
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        55⤵
        
        PID:12708
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240657781.bat
        56⤵
        
        PID:14412
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        56⤵
        
        PID:2144
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240658171.bat
        57⤵
        
        PID:2600
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        57⤵
        
        PID:1448
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240658734.bat
        58⤵
        
        PID:14956
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        58⤵
        
        PID:16380
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240659265.bat
        59⤵
        
        PID:9404
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        59⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240659718.bat
        60⤵
        
        PID:3288
        
        C:\Windows\SysWOW64\posqatyu.exe
        
        C:\Windows\system32\posqatyu.exe
        60⤵
        
        PID:17620
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240660234.bat
        61⤵
        
        PID:17668
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240660671.bat
        60⤵
        
        PID:12160
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240660718.bat
        59⤵
        
        PID:17048
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240660734.bat
        58⤵
        
        PID:16828
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240660781.bat
        57⤵
        
        PID:16776
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240660812.bat
        56⤵
        
        PID:16932
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240660937.bat
        55⤵
        
        PID:9748
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240660953.bat
        54⤵
        
        PID:5144
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240661000.bat
        53⤵
        
        PID:14248
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240661046.bat
        52⤵
        
        PID:16532
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240661140.bat
        51⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240655234.bat
        50⤵
        
        PID:12844
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240664625.bat
        50⤵
        
        PID:17500
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240664656.bat
        49⤵
        
        PID:17552
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240664687.bat
        48⤵
        
        PID:17584
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240664750.bat
        47⤵
        
        PID:4064
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240653359.bat
        46⤵
        
        PID:10560
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240664796.bat
        46⤵
        
        PID:17744
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240664828.bat
        45⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240665093.bat
        44⤵
        
        PID:17076
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240665140.bat
        43⤵
        
        PID:4988
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240665187.bat
        42⤵
        
        PID:16316
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240665328.bat
        41⤵
        
        PID:18396
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240665453.bat
        40⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240665484.bat
        39⤵
        
        PID:2908
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240665593.bat
        38⤵
        
        PID:17100
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240665640.bat
        37⤵
        
        PID:11576
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240665718.bat
        36⤵
        
        PID:10284
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240665765.bat
        35⤵
        
        PID:15020
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240666062.bat
        27⤵
        
        PID:16480
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240666140.bat
        25⤵
        
        PID:10420
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240666187.bat
        24⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240666375.bat
        19⤵
        
        PID:16016
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240666531.bat
        18⤵
        
        PID:3308
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240666578.bat
        17⤵
        
        PID:11760
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240666765.bat
        16⤵
        
        PID:17396
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240666812.bat
        15⤵
        
        PID:16420
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240666843.bat
        14⤵
        
        PID:11064
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240666859.bat
        13⤵
        
        PID:13012
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240666906.bat
        12⤵
        
        PID:15096
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240666937.bat
        11⤵
        
        PID:17380
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240666968.bat
        10⤵
        
        PID:13052
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240636156.bat
        9⤵
        
        PID:10912
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240667031.bat
        9⤵
        
        PID:10928
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240666750.bat
        8⤵
        
        PID:2772
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240665625.bat
        5⤵
        
        PID:2388
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240665359.bat
      4⤵
      PID:18240
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240665093.bat
    3⤵
    PID:8696

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240638328.bat
1⤵
PID:10864

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240639718.bat
1⤵
PID:5132

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240641156.bat
1⤵
PID:5804

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240651046.bat
1⤵
PID:11976

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240654828.bat
1⤵
PID:15464

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240656421.bat
1⤵
PID:14980

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240657281.bat
1⤵
PID:7180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

~DFD240598687.bat

Path C:\Users\Admin\AppData\Local\Temp\~DFD240598687.bat
Size 121B
SHA256 6cc6bbb1f3f754b6894d84130f5f2d86569ac3a603e1632d3cefa028f22b6238
MD5 09517fc62284f33e877a276463580bd1
SHA1 0b14fe1db4493818f9de0bf2a56ee5370b8d479a
SHA512 1b924dd216d0f38199cc6df215e65ff260aa48fa37aa620dabcbc616f434643bd1f2e617d66b14bd52900214148741565128ba9589782ba582fd7308369f4a4d
MD5 SHA1 SHA512

Submit Download

~DFD240630437.bat

Path C:\Users\Admin\AppData\Local\Temp\~DFD240630437.bat
Size 121B
SHA256 696741456a2781ba4548de78cac3dd18437a2c3eb240601111d52f0dce4e0487
MD5 d4cf16be18a19aa9a168fee771d92eac
SHA1 7142d12a0d4d780645f9da4c318b9f676795ed75
SHA512 3af062da988657962c0a424f74da50fa910b98939206b138c524c489d4dc5b6ccd8c0e2c842b564745ee289335e9a84e2543e27efdd7d7abd9750ea02adc7364
MD5 SHA1 SHA512

Submit Download

cgsqatyu.sys

Path C:\Windows\SysWOW64\cgsqatyu.sys
Size 520B
SHA256 7e8f168f94e727f599cf6436f8394f022c7f89e08de57308f410eb67b646d7f1
MD5 8ef356c14d12343dba44efbd128644ff
SHA1 99d27f6c8dfedc3abbcac4c5ebc38c68d7a5142d
SHA512 3d690726be154497d469765eed38420ea1972ca8c6cee4c7ed5e37fb4ea90c4fc9c83dd8fc098a249c5700c408d72d2137416e5a9a8bff1a88ecabf1ce3ad379
MD5 SHA1 SHA512

Submit Download

posqatyu.exe

Path C:\Windows\SysWOW64\posqatyu.exe
Size 14KB
SHA256 1dc110292c7ba4cb4a309579c0c502cb05c86e04973e7e7652676cc21c6f3f89
MD5 9f257b8fbb88e67d6cdfdc36fd8ba11a
SHA1 abf1c8a1d9a0e1febfc670f76177843e015d590d
SHA512 87fab3016647d45aa08474b0eccbe7bb4cbe5373a696d7358592ab33785031178714d98174c66190a0578248fadc330b3d9dabc13f3b86bdcc23f964b3de6e5e
SSDEEP 384:IQp76MjlsBTctIEZ4xqALsdRuZpMPd13j2raL3gn:4qsB1k4ISIE70vjGa4
MD5 SHA1 SHA512 SSDEEP

Submit Download

tisqatyu.dll

Path C:\Windows\SysWOW64\tisqatyu.dll
Size 520KB
SHA256 d8415dfb6cfc9129bc76607f671c675c03efb581e8da09a655c8bc54353f7402
MD5 073ca69bd52255a71a23bf91cd5aee58
SHA1 06ce7dc2defa7f195cbc6489dbfe5638106a3784
SHA512 8a882ed24eb6f456595482b84f605aaf7151ca821bee1ccb39bf935156241652ff14eb993ad5ba10151cadcb32abda81bed9a0b7f16ce4787f117aa7b7bbea6f
SSDEEP 384:EpdNjtU2ORljKhzBfQjQ05N1gua7I7mZ8fWDhh3m97YzDhQ85:EpdSjQ0Duh7I7vfWDhBJDhQ6
MD5 SHA1 SHA512 SSDEEP

Submit Download

tisqatyu.dll

Path C:\Windows\SysWOW64\tisqatyu.dll
Size 282KB
SHA256 7bda82da64b135103adce5c08cd570d937271acde388fb83c910af02446e56a6
MD5 80548f072fb68a5fb95c49fc9f0b11b3
SHA1 998adc3d175a4ef3ba74e66e606a0efb75da9794
SHA512 21c84fb24e30f825ddb6bb4569e6e1d82529a5696edd5442f4cbc3cb276731088c338eb2ff338f9adcd09e7a6ca31eed3b42c4c5cfe2531cdb9f2b8eb0f5abd5
SSDEEP 384:EpdNjtU2ORljKhzBfQjQ05N1gua7I7mZ8fWDhh3m97YzDhQ8:EpdSjQ0Duh7I7vfWDhBJDhQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

tisqatyu.dll

Path C:\Windows\SysWOW64\tisqatyu.dll
Size 520KB
SHA256 528d02461e92b9228e1ca2ffd7bb37f53d6daee9ac2dd643734a6d884f62e1bc
MD5 4be6e2d8afa09d7cc989f5df52b8e2c5
SHA1 87a96fd602dd2f08202c54b9669f97aff8dc3f26
SHA512 00f6617571d3bc7d22d662c135a7fabc5d4a3e6ed8e11dc8bd5ca5ce39bf4f4f084673ca64ee779f7fa4addd78b4b98faef1c5cb5b11660770c5c2ef07770ebf
SSDEEP 384:EpdNjtU2ORljKhzBfQjQ05N1gua7I7mZ8fWDhh3m97YzDhQ8A:EpdSjQ0Duh7I7vfWDhBJDhQL
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1068-1339-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/1892-0-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/1892-12684-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/6496-62697-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/8504-29366-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/9144-123393-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/13700-88980-0x0000000000400000-0x0000000000419000-memory.dmp

Download