313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b

Analysis

max time kernel
149s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20250619-en
resource tags

arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2026, 10:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
Size 2.7MB
Sample260511-mamltsas8l
SHA256 313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b
MD5 bb42e12cb89efb6249df1506568693f0
SHA1 d2e7b48d9ad0b87e418f18b26b03e2e34b6eccf0
SHA512 31ce6a38722c739c193c5f303d37fda629b923f025155752e91a4fcbe1e90130a5e45afdd675fd4f2c7e36a2bfc2f8222cc70b01c6b26e11b61f1163bcf44901
SSDEEP 49152:iLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLC:iLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLC
TLSH
T190D5D081A3D99479D583163440B38FCFE7696461E7118B8FA16403FDEDC02E5AE2AFB4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 64 IoCs

pid	Process
5588	Logo1_.exe
5112	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
4012	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
2732	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
980	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
3788	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
4572	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
4800	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
4296	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
4576	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
4884	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
2892	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
1056	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
1860	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
2776	Logo1_.exe
5476	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
1704	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
4488	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
5604	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
4956	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
1964	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
964	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
5448	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
3904	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
2744	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
5756	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
1564	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
1408	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
2132	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
2612	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
4344	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
6120	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
5516	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
2376	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
5704	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
4820	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
3992	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
1932	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
1100	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
5520	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
5144	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
6088	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
652	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
5072	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
3596	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
3988	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
748	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
2512	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
6124	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
5576	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
1332	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
1132	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
464	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
5428	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
5660	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
760	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
1672	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
2992	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
2792	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
2528	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
1640	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
820	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
636	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
4560	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe

Enumerates connected drives 3 TTPs 42 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Dll.dll	Logo1_.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File opened for modification	C:\Windows\rundl132.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
File created	C:\Windows\Logo1_.exe	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4148	5588	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4992	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
4992	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
4992	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
4992	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
4992	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
4992	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
4992	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
4992	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
4992	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
4992	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
4992	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
4992	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
4992	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
4992	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
4992	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
4992	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
4992	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
4992	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
5588	Logo1_.exe
5588	Logo1_.exe
5588	Logo1_.exe
5588	Logo1_.exe
5588	Logo1_.exe
5588	Logo1_.exe
5588	Logo1_.exe
5588	Logo1_.exe
5588	Logo1_.exe
5588	Logo1_.exe
5588	Logo1_.exe
5588	Logo1_.exe
5588	Logo1_.exe
5588	Logo1_.exe
5588	Logo1_.exe
5588	Logo1_.exe
5588	Logo1_.exe
5588	Logo1_.exe
5588	Logo1_.exe
5588	Logo1_.exe
5588	Logo1_.exe
5588	Logo1_.exe
5588	Logo1_.exe
5588	Logo1_.exe
5588	Logo1_.exe
5588	Logo1_.exe
5588	Logo1_.exe
5588	Logo1_.exe
5588	Logo1_.exe
5588	Logo1_.exe
5588	Logo1_.exe
5588	Logo1_.exe
5588	Logo1_.exe
5588	Logo1_.exe
5588	Logo1_.exe
5588	Logo1_.exe
5588	Logo1_.exe
5588	Logo1_.exe
5588	Logo1_.exe
5588	Logo1_.exe
5588	Logo1_.exe
5588	Logo1_.exe
5588	Logo1_.exe
5588	Logo1_.exe
1860	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
1860	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1804	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 3984	4992	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe	83
PID 4992 wrote to memory of 5588	4992	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe	84
PID 5588 wrote to memory of 3248	5588	Logo1_.exe	86
PID 3248 wrote to memory of 5868	3248	net.exe	88
PID 3984 wrote to memory of 5112	3984	cmd.exe	89
PID 5112 wrote to memory of 5016	5112	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe	90
PID 5016 wrote to memory of 4012	5016	cmd.exe	92
PID 4012 wrote to memory of 1948	4012	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe	93
PID 1948 wrote to memory of 2732	1948	cmd.exe	95
PID 2732 wrote to memory of 3212	2732	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe	96
PID 3212 wrote to memory of 980	3212	cmd.exe	98
PID 980 wrote to memory of 664	980	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe	99
PID 664 wrote to memory of 3788	664	cmd.exe	101
PID 3788 wrote to memory of 1836	3788	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe	102
PID 1836 wrote to memory of 4572	1836	cmd.exe	104
PID 4572 wrote to memory of 4648	4572	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe	105
PID 4648 wrote to memory of 4800	4648	cmd.exe	107
PID 4800 wrote to memory of 4708	4800	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe	108
PID 4708 wrote to memory of 4296	4708	cmd.exe	110
PID 4296 wrote to memory of 2272	4296	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe	111
PID 2272 wrote to memory of 4576	2272	cmd.exe	113
PID 4576 wrote to memory of 4964	4576	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe	114
PID 4964 wrote to memory of 4884	4964	cmd.exe	116
PID 4884 wrote to memory of 4460	4884	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe	117
PID 4460 wrote to memory of 2892	4460	cmd.exe	119
PID 2892 wrote to memory of 3080	2892	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe	120
PID 3080 wrote to memory of 1056	3080	cmd.exe	123
PID 1056 wrote to memory of 2204	1056	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe	125
PID 2204 wrote to memory of 1860	2204	cmd.exe	128
PID 1860 wrote to memory of 1576	1860	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe	129
PID 1860 wrote to memory of 2776	1860	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe	130
PID 2776 wrote to memory of 3520	2776	Logo1_.exe	132
PID 3520 wrote to memory of 3868	3520	net.exe	134
PID 1576 wrote to memory of 5476	1576	cmd.exe	135
PID 5476 wrote to memory of 5776	5476	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe	136
PID 5776 wrote to memory of 1704	5776	cmd.exe	138
PID 1704 wrote to memory of 6104	1704	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe	139
PID 6104 wrote to memory of 4488	6104	cmd.exe	141
PID 4488 wrote to memory of 4604	4488	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe	142
PID 4604 wrote to memory of 5604	4604	cmd.exe	144
PID 5604 wrote to memory of 4600	5604	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe	145
PID 4600 wrote to memory of 4956	4600	cmd.exe	147
PID 4956 wrote to memory of 2016	4956	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe	148
PID 2016 wrote to memory of 1964	2016	cmd.exe	150
PID 1964 wrote to memory of 3688	1964	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe	151
PID 3688 wrote to memory of 964	3688	cmd.exe	153
PID 964 wrote to memory of 5764	964	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe	154
PID 5764 wrote to memory of 5448	5764	cmd.exe	156
PID 5448 wrote to memory of 3340	5448	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe	157
PID 3340 wrote to memory of 3904	3340	cmd.exe	159
PID 3904 wrote to memory of 6048	3904	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe	160
PID 6048 wrote to memory of 2744	6048	cmd.exe	162
PID 2744 wrote to memory of 1956	2744	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe	163
PID 1956 wrote to memory of 5756	1956	cmd.exe	165
PID 5756 wrote to memory of 1200	5756	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe	166
PID 1200 wrote to memory of 1564	1200	cmd.exe	168
PID 1564 wrote to memory of 3628	1564	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe	169
PID 3628 wrote to memory of 1408	3628	cmd.exe	171
PID 1408 wrote to memory of 1608	1408	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe	172
PID 1608 wrote to memory of 2132	1608	cmd.exe	174
PID 2132 wrote to memory of 4132	2132	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe	175
PID 4132 wrote to memory of 2612	4132	cmd.exe	177
PID 2612 wrote to memory of 5136	2612	313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe	178
PID 5136 wrote to memory of 4344	5136	cmd.exe	180

C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
"C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a76E5.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3984
- - C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
    "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:5112
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a78BA.bat
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5016
    - - C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4012
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7ACD.bat
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2732
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7BF6.bat
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:3212
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        9⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:980
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7D1F.bat
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:664
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3788
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7EA6.bat
        12⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1836
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        13⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4572
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a80B9.bat
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4800
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a82DC.bat
        16⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4296
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a84B1.bat
        18⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        19⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:4576
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8676.bat
        20⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        21⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:4884
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a87ED.bat
        22⤵
        Suspicious use of WriteProcessMemory
        
        PID:4460
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        23⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2892
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8973.bat
        24⤵
        Suspicious use of WriteProcessMemory
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        25⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1056
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8BD5.bat
        26⤵
        Suspicious use of WriteProcessMemory
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        27⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1860
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E94.bat
        28⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1576
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        29⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:5476
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9134.bat
        30⤵
        Suspicious use of WriteProcessMemory
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        31⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:1704
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9366.bat
        32⤵
        Suspicious use of WriteProcessMemory
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        33⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:4488
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a95B8.bat
        34⤵
        Suspicious use of WriteProcessMemory
        
        PID:4604
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        35⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:5604
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9710.bat
        36⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        37⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4956
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a97EA.bat
        38⤵
        Suspicious use of WriteProcessMemory
        
        PID:2016
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        39⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1964
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9952.bat
        40⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3688
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        41⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:964
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A5B.bat
        42⤵
        Suspicious use of WriteProcessMemory
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        43⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:5448
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B46.bat
        44⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        45⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3904
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C11.bat
        46⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        47⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:2744
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D0B.bat
        48⤵
        Suspicious use of WriteProcessMemory
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        49⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:5756
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9DE6.bat
        50⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1200
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        51⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:1564
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9EB1.bat
        52⤵
        Suspicious use of WriteProcessMemory
        
        PID:3628
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        53⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:1408
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F5D.bat
        54⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        55⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:2132
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA095.bat
        56⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4132
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        57⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:2612
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA170.bat
        58⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        59⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4344
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA25A.bat
        60⤵
        
        PID:3308
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        61⤵
        Executes dropped EXE
        
        PID:6120
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA335.bat
        62⤵
        System Location Discovery: System Language Discovery
        
        PID:5052
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        63⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:5516
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA41F.bat
        64⤵
        
        PID:1180
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        65⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2376
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA4BC.bat
        66⤵
        System Location Discovery: System Language Discovery
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        67⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:5704
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA596.bat
        68⤵
        System Location Discovery: System Language Discovery
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        69⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4820
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA623.bat
        70⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        71⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3992
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA690.bat
        72⤵
        
        PID:1196
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        73⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1932
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA70D.bat
        74⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        75⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1100
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA78A.bat
        76⤵
        System Location Discovery: System Language Discovery
        
        PID:372
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        77⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:5520
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA7E8.bat
        78⤵
        System Location Discovery: System Language Discovery
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        79⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5144
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA856.bat
        80⤵
        System Location Discovery: System Language Discovery
        
        PID:448
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        81⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:6088
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA8D3.bat
        82⤵
        System Location Discovery: System Language Discovery
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        83⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:652
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA940.bat
        84⤵
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        85⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:5072
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA9AD.bat
        86⤵
        System Location Discovery: System Language Discovery
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        87⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3596
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA1B.bat
        88⤵
        
        PID:2128
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        89⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3988
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA88.bat
        90⤵
        
        PID:4124
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        91⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:748
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB05.bat
        92⤵
        System Location Discovery: System Language Discovery
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        93⤵
        Executes dropped EXE
        
        PID:2512
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB92.bat
        94⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        95⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:6124
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aABE0.bat
        96⤵
        System Location Discovery: System Language Discovery
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        97⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5576
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC5D.bat
        98⤵
        System Location Discovery: System Language Discovery
        
        PID:3128
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        99⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1332
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aACCA.bat
        100⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        101⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1132
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD47.bat
        102⤵
        System Location Discovery: System Language Discovery
        
        PID:544
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        103⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:464
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aADA5.bat
        104⤵
        System Location Discovery: System Language Discovery
        
        PID:952
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        105⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5428
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE12.bat
        106⤵
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        107⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:5660
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE80.bat
        108⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        109⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:760
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAEDD.bat
        110⤵
        
        PID:1012
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        111⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1672
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF5A.bat
        112⤵
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        113⤵
        Drops file in Windows directory
        
        PID:6060
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAFC8.bat
        114⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        115⤵
        Executes dropped EXE
        
        PID:2992
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB045.bat
        116⤵
        System Location Discovery: System Language Discovery
        
        PID:3152
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        117⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2792
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB0D1.bat
        118⤵
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        119⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2528
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB15E.bat
        120⤵
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        121⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1640
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB1EB.bat
        122⤵
        System Location Discovery: System Language Discovery
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        123⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:820
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB268.bat
        124⤵
        System Location Discovery: System Language Discovery
        
        PID:552
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        125⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:636
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB304.bat
        126⤵
        System Location Discovery: System Language Discovery
        
        PID:4232
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        127⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4560
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB3A0.bat
        128⤵
        
        PID:4664
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        129⤵
        Drops file in Windows directory
        
        PID:4636
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB43C.bat
        130⤵
        System Location Discovery: System Language Discovery
        
        PID:620
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        131⤵
        Drops file in Windows directory
        
        PID:444
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB4AA.bat
        132⤵
        
        PID:4756
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        133⤵
        Drops file in Windows directory
        
        PID:5512
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB527.bat
        134⤵
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        135⤵
        Drops file in Windows directory
        
        PID:4740
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB594.bat
        136⤵
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        137⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2284
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB630.bat
        138⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        139⤵
        
        PID:968
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB69E.bat
        140⤵
        System Location Discovery: System Language Discovery
        
        PID:3380
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        141⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5968
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB73A.bat
        142⤵
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        143⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:6136
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB7A7.bat
        144⤵
        
        PID:4396
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        145⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5936
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB7F6.bat
        146⤵
        
        PID:3948
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        147⤵
        Drops file in Windows directory
        
        PID:2676
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB863.bat
        148⤵
        System Location Discovery: System Language Discovery
        
        PID:2172
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        149⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2480
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB8D0.bat
        150⤵
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        151⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5716
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB92E.bat
        152⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\313aea77ccb204c56aa615995c01b2b85574584db794eb58daa0f5dd55cf0e6b.exe"
        153⤵
        System Location Discovery: System Language Discovery
        
        PID:4280
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB9CA.bat
        154⤵
        Checks computer location settings
        Suspicious use of SetWindowsHookEx
        
        PID:1804
        
        C:\Windows\Logo1_.exe
        
        C:\Windows\Logo1_.exe
        28⤵
        Executes dropped EXE
        Enumerates connected drives
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:2776
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Kingsoft AntiVirus Service"
        29⤵
        Suspicious use of WriteProcessMemory
        
        PID:3520
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        30⤵
        
        PID:3868
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5588
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3248
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5868
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5588 -s 760
    3⤵
    - Program crash
    PID:4148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5588 -ip 5588
1⤵
PID:4524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

$$a76E5.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a76E5.bat
Size 722B
SHA256 039ba87c03524ed6d198c436d7e57ffccd760cd92bf971c1631009d08b93f7f2
MD5 250eb3481b2a7d3ab25af91967c03b2c
SHA1 2b9eea2bc4840d73ba6f468e2c195d166b093a45
SHA512 c8b9701eb2918c08809739d402809be832a849da84863f52fafaf7674b5220b8ebbb45424be33a254912dafc52b7b72e3a1514da6cd8bf79144ecc42bb985b15
TLSH
T1010196499C86EAEE050443B76970246DEDE2787D2BD46AB28D10C94987B3C2E58CA782
MD5 SHA1 SHA512 TLSH

Submit Download

$$a78BA.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a78BA.bat
Size 722B
SHA256 7a7bb63884fadba78bcdd01c52e937443c2ede36b93e3ca31e07d96baa0cc6c2
MD5 9bd530d43dca1b8d25bde52306972978
SHA1 6d1478b3b5f51eecaa27893e8aae806b80f943aa
SHA512 12680462164686799f1bb89e7f103fa65557e99403f764c410e329ccbc1765a3b0b81f30f2312fcedabd81547c844d4395525c6beb968facc6b468ed329a26d5
TLSH
T1B6019B49AC46E6EE050443B76970246DEDD2747D2BD46EB28D10C94986B3C2D58CA782
MD5 SHA1 SHA512 TLSH

Submit Download

$$a7ACD.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a7ACD.bat
Size 722B
SHA256 57de947f4157252f26c25054f000bb6abe07db9fe394bb8f744ae82c30a8baf8
MD5 248126a5acbbac72d75174314dc3fae7
SHA1 75caa101f06f3b6fd485f5670094db913dea4d0c
SHA512 39e99467add5faecc8abf49df3d83fecfe1a8e31f1ed615cb5af27956d85d7f478a88c9a62d88019a6cdff22195d17b3ba248cfb1f511fe31658c13185f34bab
TLSH
T1D201DB499C46E5EE050443B76870243DEDD2747D2BD46AB28D10C90986B3C2D58CA782
MD5 SHA1 SHA512 TLSH

Submit Download

$$a7BF6.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a7BF6.bat
Size 722B
SHA256 77e1fa675c237f83e1790feaa1ce7ec71969bd57386459bf71e2d4ea103b1706
MD5 0130b323d55d692861bb10fb8168790d
SHA1 cb90074ea685a970f1457b5fa075e8c8d6bce1c5
SHA512 565ef897560be018fa267708e2452333c1afc7812a9bbbe3927aa2a10eb8cb6c14c990b2a548a482a100c81723170f92610384a4bbcaa18a488f544980f8bbdf
TLSH
T1F7019B499C46E5EE050443B76970246DEDD2747D2BD46AB28D14C94D86B3C2D58CA782
MD5 SHA1 SHA512 TLSH

Submit Download

$$a7D1F.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a7D1F.bat
Size 722B
SHA256 8583d736a45889c8f29e1027fa02111302c5d768e09a7f893476e79cb9fb1994
MD5 a7d27472c9048269634bd07c8ed1e637
SHA1 4687bc3a0553c5a6b3b27c0405b214149b57b9cc
SHA512 32229f115212d2501b9e7cd54abd5992033bdfdfbb115e79753f49d222e053235a7e944adee3e8681ff83baa73a9a8da3e0912b92e6c4db95fded70b9c01206f
TLSH
T1E0019B499C46E5EE050443B76970246DEDD2747D2BD46AB28D10C94986B3C2D58DA782
MD5 SHA1 SHA512 TLSH

Submit Download

$$a7EA6.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a7EA6.bat
Size 722B
SHA256 378fdde9a5996a91bf1643a3c2cdc37410269bfe1f7bbf08cb96b94ba3a3229b
MD5 14812033fe64cfcdbc6aca64675e7186
SHA1 773b742e9bc59817dce054c9a8869ef1f3c571a3
SHA512 805e23f9b91c760919b573050f800bc30ad84e1bab43921fd90bea233db2db28747de10a9496c9d9c29c49c8dbceed3a1d49a8d6e3161b9e25640890fc4e4577
TLSH
T12D0196499C86EAEE050443B76970246DEDE2787D2BD46AB28D10C95986B3C2E58CA782
MD5 SHA1 SHA512 TLSH

Submit Download

$$a80B9.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a80B9.bat
Size 722B
SHA256 b739447e75447101934a7ae8c79834c1b83a4c06e7f3ad842fb017ba8b4910f4
MD5 cb6c767420cec03a08782efe2b1a9238
SHA1 d7a6186dbf424fea672f01269b1e92d84bd19d73
SHA512 f205776fca6217d2c270c2e6fab5ccd6bf3f328d3a37cadce0456c5a454de5d11d97460f215116756e70cd73f82274e44fe974149da37effb161410e73e8ba5a
TLSH
T1710196499C86EAEE050443B76970246DEDE2787D2BD46AB28D10C94D87F3C2E58CA782
MD5 SHA1 SHA512 TLSH

Submit Download

$$a82DC.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a82DC.bat
Size 722B
SHA256 ddbb4b419ab8ba7b8220f25aad9db0873b8d20d72d717ed2e477ec69c473d671
MD5 0f04ca29ac6db51cc7a5f66520ef2237
SHA1 319ba07d6b59079edb6145e87eac9df57b0291d3
SHA512 4f6a6a5e26fb62b901b2e437842301e34a03a979d035de49cf1ce73a5ad7b10bb228874fcbab63669703f711e808f1e34959fe70c54938219bcee533c613ba7a
TLSH
T1FD0196499C86EAEE050443B76970246DEDE2787D2BD46AB28D10C94987F3C2E58DA782
MD5 SHA1 SHA512 TLSH

Submit Download

$$a84B1.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a84B1.bat
Size 722B
SHA256 ba416d50427d815a9282c8ed087bcc6231b51082ec99c811262494153daa11bf
MD5 ee76962d7663e01268b3e6b93c81bcfd
SHA1 a6d577ce8c18c9e7c8cb7b10abb46f22e9ecf983
SHA512 09f6fb07447f0c006c6a474b13dbd536b4b1a5ed1744bd2acaaf9bd76cac21ef9a63549f417247a6e6be5899b35a124e3f05d0d724682f4b9187c1d02ea4116b
TLSH
T1360196499C86EAEF050443B76970646DEDE2787D2BD46AB28D10C94987F3C2E58CA782
MD5 SHA1 SHA512 TLSH

Submit Download

$$a8676.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a8676.bat
Size 722B
SHA256 d54757a4c7be4707acc8850c04e61e8e10269fe56e792ba68106323835504e6f
MD5 d0fb69769822c8e876180d1fa6e65ec1
SHA1 ad28ff818abf033f81895420ea0b962aab743471
SHA512 5474f8fa7e5026cf50d407329983216ba252b74d7fd3485461e7df0620458fc7a214430d416cc7ec6668e7606e0c8efdb31354acc0e5d2e96455951d95df9634
TLSH
T1EE0196499C86EAEE050443B76970246DEDE2787D2BD46AB28D10C94987F3C2E58CA782
MD5 SHA1 SHA512 TLSH

Submit Download

$$a87ED.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a87ED.bat
Size 722B
SHA256 2034f8180df58ef41fe0b92e98019221032342559edc2c9f06069ab448f253c8
MD5 1a6b08c0b74a267ec6629e236ede718f
SHA1 74ffcca85740ff9268a5bca738c27a1f06d64a49
SHA512 a98c981f619d477f447097e3892397fa8d928163d765284280350dd338f1029beb6e3f8f72b88b0ec67d2346078d421e354a23710de43f011b18b24ebe9c6f48
TLSH
T1BB019B499C46E5EE050443B76970246DEDD2747D2BD469B28D10C94987F3C2D58DA782
MD5 SHA1 SHA512 TLSH

Submit Download

$$a8973.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a8973.bat
Size 722B
SHA256 cdf1d321c326c840a8e2f01a79cc729e00a15721f6de5dc0fe600c24947ab4c2
MD5 22c80fcb76c39d226a63e9f9e6a18eef
SHA1 3ba7827d07a2a543ca3ae9ac58694e8c48bd6500
SHA512 08d65157f682c11083bda067c4aa105db21775b3e653bfe0988af5dd9afd84a5f7138cb8af1d62efc767a788b6363a87ee150286a11015ba5020d1362a266148
TLSH
T1B00196499C86EAEE050443B76970246DEDE2787D2BD46AB28D10C94987F3C2E58CA782
MD5 SHA1 SHA512 TLSH

Submit Download

$$a8BD5.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a8BD5.bat
Size 722B
SHA256 0c0fd2f4e52eebc765db381ecc28e0acf2db4e547c51305ac7a3fa2ad578fa8a
MD5 5d806e360d87cccb2dc2bfdbc6f5d284
SHA1 5d131dd13ec796ac31dbaa98218d2cbcc6791028
SHA512 2daafd9f540b111eafbd941460649d2131efd0eace56d87d174cf91f1c30932f30a15062067b0e8c3e46ae30228913d58c501f4b8d28c8395983c87d2ca738dd
TLSH
T1AE019B499C45E5EE050843B76970246DEDD2787D2BD469B28D10C95987F3C2D58CA782
MD5 SHA1 SHA512 TLSH

Submit Download

$$a8E94.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a8E94.bat
Size 722B
SHA256 87e337131ac1e60635b7df577cf4da496469184caf6bde02a4d33ff0e2866b87
MD5 9cfcf7aa83ed9b079c249efa07aa0ecd
SHA1 492ef79b6084c188580900699395f7ccd992b015
SHA512 5b82aa95b107de29194a606bec7563065242322a2dac717f2d81288195504c880f3c45eac31b54def9e9d0a1651945fbdf69d72b073775e719324d95b54c8501
TLSH
T1080196499C86EAEE050443B76970246DEDE2787D2BD46AB28D10C95987F3C2E58CA782
MD5 SHA1 SHA512 TLSH

Submit Download

$$a9134.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a9134.bat
Size 722B
SHA256 8bc578958b0c0e0a3f2d477d4328f65da64dfc1461062f0b46b59c4c44544677
MD5 8f7f65f7036f11c09f65ee0f42e1aa2b
SHA1 e95aa828d50c4e4b12841c5a342cf4d38e1aedae
SHA512 4b7a4bbe1eb5afddf5f57e690b5e065ce5c34c4131534535e2e18269ea2c55454691081c9cfd8bf232f94963323a4d84c92a58a39ab59811d6b6dc7ea290ccc7
TLSH
T1A201DB499C45E5EE050443B76870242DEDD2747D2BD469B28D10C90996B3C2D58CA782
MD5 SHA1 SHA512 TLSH

Submit Download

$$a9366.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a9366.bat
Size 722B
SHA256 f551ac69d46f6d6ffde2be789b9b055a91f2dd7621cc4a52f9da07893a58c833
MD5 579d8cbdab85ce7acaac757266771c26
SHA1 b09fa085349ab9b3c7214ae4a75ade406eb63d99
SHA512 f749fb94f020a2abfdc11c8fc7759014dbc7352ce699f269db8c8fa5463f246bcf2009ad01e1bc01cd6fe67a078f80fd6beaa28537c262e50decf1e2d691c2c5
TLSH
T124019B499C45E5EE050443B76970246DEDE2747D2BD469B28D14C94986F3C2D58CA782
MD5 SHA1 SHA512 TLSH

Submit Download

$$a95B8.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a95B8.bat
Size 722B
SHA256 5f452f8c4b0e5df5b8d0dd49a04b4719acaf0cf6eb0afb099fe3af617161becf
MD5 bf3d27a2f3f321c8f37088e55e6c658e
SHA1 c561b9f67cc0db171df830d7b7811095ab9fc6ac
SHA512 fa86bb412d00b35947c4fc5145f751b953d7c354862423518d9c5f9cd16df2e2a0187855f47b97c63aa9635761ae6255f285976fc61f5607c800d16fe28ec75e
TLSH
T1F401DB499C46E5EF050443B76970243DEDD2747D2BD46AB28D10C90986B3C2D58CA782
MD5 SHA1 SHA512 TLSH

Submit Download

$$a9710.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a9710.bat
Size 722B
SHA256 afb942238c2ebcfbad7657867231d867267d30136403d7a815dbac771fde7a53
MD5 ef8f86f55bb14bf644d088e53b0fc01f
SHA1 60cf4c8641a13e2568d97f4560f791610583b3c1
SHA512 5f019a2a5f13267f62141f6b3d6ed6faf9cfb134d54ff9875e1b33e1546c61c64d1db152aee307ea2ab56875936827d8e979f5e3891b85a19d38a8f881254b53
TLSH
T188019B499C45E5EF050443B76970246DEDD2747D2BD469B28D10C94986B3C2D58DA782
MD5 SHA1 SHA512 TLSH

Submit Download