ad2d9e9ccf4071b62734a41e10deb2f488aa6991b24eb4d291bed295a83fd3d7

Analysis

max time kernel
2s
max time network
16s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 17:03

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

d006bac7387f1928c1ce6b8a26605311_JaffaCakes118.exe
Size

255KB
MD5

d006bac7387f1928c1ce6b8a26605311
SHA1

2bfc6117f49fdc4e01e41057eb9433aa8d3e3052
SHA256

ad2d9e9ccf4071b62734a41e10deb2f488aa6991b24eb4d291bed295a83fd3d7
SHA512

477686222adb487030904d4c405155ce125366a41e13cee9a76253947faf5b3f8002d45bc6f1567f8ecd19b68c73b5dc8c2cd76df21daabc82ec6ab7277978b0
SSDEEP

6144:YoTf1YERoTf1YEzoTf1Y06Ifn8xAfIn2uR:YoTfDRoTf7zoTf7rn8egn2u

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 23 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	Queue.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	Queue.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	Queue.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	Queue.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	Queue.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	Queue.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	Queue.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	Queue.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	Queue.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	Queue.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	Queue.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	Queue.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	Queue.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	Queue.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	Queue.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	Queue.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	Queue.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	Queue.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	Queue.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	Queue.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	Queue.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	d006bac7387f1928c1ce6b8a26605311_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	2b2t.exe

Drops startup file 15 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0W4-e!10051.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0W4-e!10054.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0W4-e!10054.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0W4-e!10054.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0W4-e!10054.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0W4-!10628.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0W4-e!10051.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0W4-e!10051.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0W4-e!10051.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0W4-e!10051.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0W4-e!10051.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0W4-e!10054.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0W4-e!10054.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0W4-e!10051.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0W4-e!10054.exe	cmd.exe

Executes dropped EXE 27 IoCs

pid	Process
1540	2b2t.exe
1128	Queue.exe
756	Queue.exe
316	Queue.exe
112	Queue.exe
2376	Queue.exe
2464	Queue.exe
4596	Queue.exe
1488	Queue.exe
2184	Queue.exe
4024	Queue.exe
4256	Queue.exe
4416	Queue.exe
4532	Queue.exe
4964	Queue.exe
928	Queue.exe
1860	Queue.exe
3752	Queue.exe
2504	Queue.exe
3484	Queue.exe
624	Queue.exe
1968	Queue.exe
5128	Queue.exe
5136	Queue.exe
5504	Queue.exe
5512	Queue.exe
5520	Queue.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 27 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Queue.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Queue.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d006bac7387f1928c1ce6b8a26605311_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Queue.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Queue.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Queue.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Queue.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Queue.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Queue.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Queue.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Queue.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Queue.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Queue.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Queue.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2b2t.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Queue.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Queue.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Queue.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Queue.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Queue.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Queue.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Queue.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Queue.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Queue.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Queue.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Queue.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Queue.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3720	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3720	PING.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 2600	2016	d006bac7387f1928c1ce6b8a26605311_JaffaCakes118.exe	84
PID 2016 wrote to memory of 2600	2016	d006bac7387f1928c1ce6b8a26605311_JaffaCakes118.exe	84
PID 2600 wrote to memory of 1540	2600	cmd.exe	88
PID 2600 wrote to memory of 1540	2600	cmd.exe	88
PID 2600 wrote to memory of 1540	2600	cmd.exe	88
PID 2600 wrote to memory of 3720	2600	cmd.exe	89
PID 2600 wrote to memory of 3720	2600	cmd.exe	89
PID 1540 wrote to memory of 1088	1540	2b2t.exe	91
PID 1540 wrote to memory of 1088	1540	2b2t.exe	91
PID 1088 wrote to memory of 1128	1088	cmd.exe	93
PID 1088 wrote to memory of 1128	1088	cmd.exe	93
PID 1088 wrote to memory of 1128	1088	cmd.exe	93
PID 1128 wrote to memory of 4444	1128	Queue.exe	94
PID 1128 wrote to memory of 4444	1128	Queue.exe	94
PID 4444 wrote to memory of 316	4444	cmd.exe	96
PID 4444 wrote to memory of 316	4444	cmd.exe	96
PID 4444 wrote to memory of 316	4444	cmd.exe	96
PID 4444 wrote to memory of 756	4444	cmd.exe	97
PID 4444 wrote to memory of 756	4444	cmd.exe	97
PID 4444 wrote to memory of 756	4444	cmd.exe	97
PID 756 wrote to memory of 384	756	Queue.exe	98
PID 756 wrote to memory of 384	756	Queue.exe	98
PID 316 wrote to memory of 2164	316	Queue.exe	100
PID 316 wrote to memory of 2164	316	Queue.exe	100
PID 384 wrote to memory of 112	384	cmd.exe	102
PID 384 wrote to memory of 112	384	cmd.exe	102
PID 384 wrote to memory of 112	384	cmd.exe	102
PID 384 wrote to memory of 2376	384	cmd.exe	103
PID 384 wrote to memory of 2376	384	cmd.exe	103
PID 384 wrote to memory of 2376	384	cmd.exe	103
PID 2164 wrote to memory of 2464	2164	cmd.exe	104
PID 2164 wrote to memory of 2464	2164	cmd.exe	104
PID 2164 wrote to memory of 2464	2164	cmd.exe	104
PID 2164 wrote to memory of 4596	2164	cmd.exe	105
PID 2164 wrote to memory of 4596	2164	cmd.exe	105
PID 2164 wrote to memory of 4596	2164	cmd.exe	105
PID 2464 wrote to memory of 2348	2464	Queue.exe	106
PID 2464 wrote to memory of 2348	2464	Queue.exe	106
PID 2376 wrote to memory of 4144	2376	Queue.exe	107
PID 2376 wrote to memory of 4144	2376	Queue.exe	107
PID 4596 wrote to memory of 2332	4596	Queue.exe	110
PID 4596 wrote to memory of 2332	4596	Queue.exe	110
PID 112 wrote to memory of 2492	112	Queue.exe	112
PID 112 wrote to memory of 2492	112	Queue.exe	112
PID 2348 wrote to memory of 1488	2348	cmd.exe	114
PID 2348 wrote to memory of 1488	2348	cmd.exe	114
PID 2348 wrote to memory of 1488	2348	cmd.exe	114
PID 2348 wrote to memory of 2184	2348	cmd.exe	115
PID 2348 wrote to memory of 2184	2348	cmd.exe	115
PID 2348 wrote to memory of 2184	2348	cmd.exe	115
PID 4144 wrote to memory of 4024	4144	cmd.exe	116
PID 4144 wrote to memory of 4024	4144	cmd.exe	116
PID 4144 wrote to memory of 4024	4144	cmd.exe	116
PID 4144 wrote to memory of 4256	4144	cmd.exe	117
PID 4144 wrote to memory of 4256	4144	cmd.exe	117
PID 4144 wrote to memory of 4256	4144	cmd.exe	117
PID 2332 wrote to memory of 4416	2332	cmd.exe	118
PID 2332 wrote to memory of 4416	2332	cmd.exe	118
PID 2332 wrote to memory of 4416	2332	cmd.exe	118
PID 1488 wrote to memory of 2996	1488	Queue.exe	119
PID 1488 wrote to memory of 2996	1488	Queue.exe	119
PID 2332 wrote to memory of 4532	2332	cmd.exe	120
PID 2332 wrote to memory of 4532	2332	cmd.exe	120
PID 2332 wrote to memory of 4532	2332	cmd.exe	120

C:\Users\Admin\AppData\Local\Temp\d006bac7387f1928c1ce6b8a26605311_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d006bac7387f1928c1ce6b8a26605311_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\87DD.tmp\87DE.bat C:\Users\Admin\AppData\Local\Temp\d006bac7387f1928c1ce6b8a26605311_JaffaCakes118.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2600
- - C:\Users\Admin\AppData\Local\Temp\87DD.tmp\2b2t.exe
    2b2t.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1540
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\89E1.tmp\89E2.bat C:\Users\Admin\AppData\Local\Temp\87DD.tmp\2b2t.exe"
      4⤵
      Drops startup file
      Suspicious use of WriteProcessMemory
      PID:1088
    - - C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        Queue.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1128
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\8AAC.tmp\8AAD.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        6⤵
        Drops startup file
        Suspicious use of WriteProcessMemory
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        7⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:316
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\8BB5.tmp\8BB6.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        8⤵
        Drops startup file
        Suspicious use of WriteProcessMemory
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        9⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2464
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\8C61.tmp\8C62.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        10⤵
        Drops startup file
        Suspicious use of WriteProcessMemory
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        11⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1488
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\8D4C.tmp\8D4D.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        12⤵
        Drops startup file
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        13⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1860
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\8F5F.tmp\8F60.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        14⤵
        
        PID:3936
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        15⤵
        
        PID:5492
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\9422.tmp\9423.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        16⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:9580
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:9696
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        15⤵
        
        PID:5576
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\9441.tmp\9442.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        16⤵
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:9456
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:9508
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        13⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3752
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\8F6F.tmp\8F70.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        14⤵
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        15⤵
        
        PID:6876
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\9664.tmp\9665.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        16⤵
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:10132
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:10152
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        15⤵
        
        PID:6944
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\96A2.tmp\96A3.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        16⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:9572
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:9608
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        11⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2184
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\8D6B.tmp\8D6C.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        12⤵
        Drops startup file
        
        PID:64
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2504
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\90A7.tmp\90B8.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        14⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        15⤵
        
        PID:6204
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\94AF.tmp\94AF.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        16⤵
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:9640
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:9756
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        15⤵
        
        PID:6216
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\94AE.tmp\94AF.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        16⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:9464
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:9516
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3484
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\90C6.tmp\90C7.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        14⤵
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        15⤵
        
        PID:7992
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\9CBD.tmp\9CBE.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        16⤵
        
        PID:8592
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:9164
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        15⤵
        
        PID:8164
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\9D0C.tmp\9D0C.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        16⤵
        
        PID:8620
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:1716
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        9⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4596
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\8C62.tmp\8C62.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        10⤵
        Drops startup file
        Suspicious use of WriteProcessMemory
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        11⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4416
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\8E26.tmp\8E27.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        12⤵
        Drops startup file
        
        PID:3880
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        13⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:624
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\90D6.tmp\90D7.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        14⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        15⤵
        
        PID:7748
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\9A4C.tmp\9A4D.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        16⤵
        
        PID:8384
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:9788
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:9808
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        15⤵
        
        PID:7848
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\9AC9.tmp\9ACA.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        16⤵
        
        PID:8376
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:10096
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:10112
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        13⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5128
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\90B8.tmp\90B8.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        14⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        15⤵
        
        PID:6912
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\9D0B.tmp\9D0C.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        16⤵
        
        PID:8648
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:7988
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        15⤵
        
        PID:7452
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\9D1B.tmp\9D1C.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        16⤵
        
        PID:8692
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:8256
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:8988
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        11⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4532
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\8E65.tmp\8E66.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        12⤵
        Drops startup file
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        13⤵
        Executes dropped EXE
        
        PID:5520
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\91C0.tmp\91C1.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        14⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        15⤵
        
        PID:6728
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\9829.tmp\982A.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        16⤵
        
        PID:7932
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:9448
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:9564
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        15⤵
        
        PID:7216
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\9887.tmp\9888.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        16⤵
        
        PID:8124
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:9480
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:9488
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        13⤵
        
        PID:5528
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\9191.tmp\9192.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        14⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        15⤵
        
        PID:7128
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\978E.tmp\978E.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        16⤵
        
        PID:7612
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:9020
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:9028
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        15⤵
        
        PID:5920
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\9771.tmp\976E.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        16⤵
        
        PID:7620
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:10064
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:10080
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        7⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:756
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\8BA6.tmp\8BA7.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        8⤵
        Drops startup file
        Suspicious use of WriteProcessMemory
        
        PID:384
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        9⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:112
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\8C81.tmp\8C82.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        10⤵
        Drops startup file
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        11⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4964
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\8E75.tmp\8E76.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        12⤵
        Drops startup file
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5504
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\91B2.tmp\91B2.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        14⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        15⤵
        
        PID:7384
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\98F4.tmp\9905.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        16⤵
        
        PID:8172
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:9868
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:9880
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        15⤵
        
        PID:7516
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\9942.tmp\9953.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        16⤵
        
        PID:8180
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:9892
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:9932
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5512
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\91B1.tmp\91B2.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        14⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        15⤵
        
        PID:7036
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\973F.tmp\9740.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        16⤵
        
        PID:7596
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:8408
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\9EB1.tmp\9EB2.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        18⤵
        
        PID:8916
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        19⤵
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        19⤵
        
        PID:8556
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:8416
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\9E92.tmp\9E93.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        18⤵
        
        PID:9044
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        15⤵
        
        PID:7060
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\9710.tmp\9711.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        16⤵
        
        PID:7412
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:2204
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\9D69.tmp\9D6A.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        18⤵
        
        PID:8632
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        19⤵
        
        PID:9832
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        19⤵
        
        PID:9860
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:8204
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\9DB7.tmp\9DB8.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        18⤵
        
        PID:8848
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        19⤵
        
        PID:9964
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        19⤵
        
        PID:10012
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        11⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:928
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\8E76.tmp\8E76.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        12⤵
        Drops startup file
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        13⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1968
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\90D7.tmp\90D7.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        14⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        15⤵
        
        PID:5768
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\9470.tmp\9471.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        16⤵
        
        PID:6528
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:9944
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:10036
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        15⤵
        
        PID:6240
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\94B1.tmp\94AF.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        16⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:9544
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:9616
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        13⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5136
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\90B7.tmp\90B8.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        14⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        15⤵
        
        PID:6684
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\9606.tmp\9607.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        16⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:9992
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:10020
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        15⤵
        
        PID:6800
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\9645.tmp\9646.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        16⤵
        
        PID:7264
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:10104
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:10120
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        9⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2376
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\8C52.tmp\8C53.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        10⤵
        Drops startup file
        Suspicious use of WriteProcessMemory
        
        PID:4144
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        11⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4024
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\8DB9.tmp\8DBA.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        12⤵
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        13⤵
        
        PID:5476
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\93E3.tmp\93E4.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        14⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        15⤵
        
        PID:7084
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\975E.tmp\975F.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        16⤵
        
        PID:7740
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:8452
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:8612
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        15⤵
        
        PID:7116
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\978D.tmp\978E.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        16⤵
        
        PID:7636
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:8392
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:8740
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        13⤵
        
        PID:4124
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\9412.tmp\9413.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        14⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        15⤵
        
        PID:9652
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        15⤵
        
        PID:9704
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        11⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4256
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\8DA9.tmp\8DAA.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        12⤵
        Drops startup file
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        13⤵
        
        PID:5588
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\91FF.tmp\9200.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        14⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        15⤵
        
        PID:7100
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\976E.tmp\976E.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        16⤵
        
        PID:7676
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:10200
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:3720
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        15⤵
        
        PID:7140
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\976D.tmp\976E.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        16⤵
        
        PID:7604
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:9224
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:9244
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        13⤵
        
        PID:5748
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\924D.tmp\924E.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        14⤵
        
        PID:5296
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        15⤵
        
        PID:5904
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\97AC.tmp\97AD.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        16⤵
        
        PID:7724
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:8404
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:9192
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        15⤵
        
        PID:6656
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\9819.tmp\981A.bat C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe"
        16⤵
        
        PID:7908
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:9556
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        
        C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe
        17⤵
        
        PID:9624
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3720
- - C:\Windows\system32\shutdown.exe
    shutdown.exe /s /t 00
    3⤵
    PID:8796

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3908055 /state1:0x41c64e6d
1⤵
PID:8960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\87DD.tmp\2b2t.exe

Filesize
185KB

MD5
36e73597948fbbcc8c1ee1c09068e1dc

SHA1
2143fd9e0cb82f4b51494c245855d405fc092ff0

SHA256
3ab4f96969c5b663203d19d7b4dc0f91d31bd65bc7662fecc37f7b788fe74985

SHA512
cb868d04217ed3a54bcab674d0f0718f5bb71e148824080799816b924f4dd1d1147b845b346aeb6dae7ded7aa269163472a06b2516bc224a86d64940bc009d65

Download Submit
C:\Users\Admin\AppData\Local\Temp\87DD.tmp\87DE.bat

Filesize
189B

MD5
054319e0976a05e18b0218f63bf57d9d

SHA1
3b6b9aed46dd9590d2ad06a72082e35ecbed829b

SHA256
8b633af759450256ef78656954933f6c81c3039798fe623fe34d4a56feb8d123

SHA512
24a5af58c81bf286c565b39012317771a87c5f67d49a2f322becc9e7a3a5db2240b0e98108418ba8981ed2fd5a1e7171658030607c359c8c374c467b7bffbcae

Download Submit
C:\Users\Admin\AppData\Local\Temp\89E1.tmp\89E2.bat

Filesize
498B

MD5
f12b60a1e6b71dc6377e698cafb960e2

SHA1
601694c10cdb76638e53859e09f8fa0bfb1b8625

SHA256
1602f10c43649d4e28357446321b36df58ed40f3692b4ce833125cdb3eccaaf4

SHA512
0e8185e77a0a057d6cd20f74a759cc0a1aba24ca9a5fcab5f0b252105631ebe4b58767809862e4db64665ebd19069992acbf02d588a0a643b83fee75df2519ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\89E1.tmp\Queue.exe

Filesize
115KB

MD5
0e6ce768bbd53a3d303875d08c76b8a8

SHA1
fc4dfa831b76433c1b6fb5950045a53ccd1f246d

SHA256
e237cf416742a3d5619bf7c92eb5df3e7ddf852ed2b94a3fa756af75679b9253

SHA512
b0e2405779a029fe44bbca4b65fbf06d964cf96ffaa4886045e99a08690cd398d1d4978ba485cf465e4c8e6dd8c58f5deb8d53cdc55e956491433d3046885a69

Download Submit
C:\Users\Admin\AppData\Local\Temp\8AAC.tmp\8AAD.bat

Filesize
156B

MD5
1e67264fbc9eb77c6b6586690dd59983

SHA1
1f092df75aea35d73f91cf38c3714cfb8f8bd3bc

SHA256
a89739b55abf4bbb145d582bcf9a8825962be4ee0340cf1ef1221dd4af764535

SHA512
feabae1315e59b55bc820b6393004efbb14076f3550d1789835dd0b2c3f1dca25e839ab53885103d70692981b49f45377d437f218510bfa38cb8820de41b3dcf

Download Submit

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads