10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
31/05/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
Size 5.8MB
Sample260531-e6mbyahv41
SHA256 10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e
MD5 4f63e782582d7b0ea35346e3ff0e6991
SHA1 cc9ee2714333519259e308b60bb1684cfe320c3a
SHA512 f7dfbae3c3d2d21c79c54be74ecd5c3d07f253c6b0d4135fbfd2d1658bbaa81839c87f642ecc416b2173fbefe8dddccf90c21bc0f528951cadc965581dc59025
SSDEEP 98304:iLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLQ:CjJa
TLSH
T1B756E08193D9A479E5C3163450B38FCBE7697461E7218B4F906402FDEDC02E5AE2AFB4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1760	Logo1_.exe
1176	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
4520	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
5096	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
356	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
5840	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
2716	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
2040	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
6124	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
2152	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
4220	Logo1_.exe
5276	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
4332	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
704	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
1656	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
4944	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
4640	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
244	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
3008	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
3224	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
3816	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
1168	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
2172	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
2804	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
5076	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
4692	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
6068	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
2512	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
3148	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
2536	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
2632	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
1380	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
3312	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
6108	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
5628	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
6056	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
1440	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
3776	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
4268	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
5284	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
1420	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
3232	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
5252	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
1860	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
3572	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
924	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
1364	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
1504	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
4632	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
1340	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
4860	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
5288	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
1268	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
1668	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
2708	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
4276	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
4040	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
4560	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
4812	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
3892	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
5568	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
576	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
3304	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
3676	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe

Enumerates connected drives 3 TTPs 42 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File opened for modification	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File created	C:\Windows\Dll.dll	Logo1_.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File opened for modification	C:\Windows\rundl132.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
File created	C:\Windows\Logo1_.exe	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5916	1760	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
412	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
412	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
412	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
412	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
412	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
412	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
412	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
412	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
412	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
412	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
412	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
412	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
412	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
412	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
412	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
412	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
412	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
412	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
1760	Logo1_.exe
1760	Logo1_.exe
1760	Logo1_.exe
1760	Logo1_.exe
1760	Logo1_.exe
1760	Logo1_.exe
1760	Logo1_.exe
1760	Logo1_.exe
1760	Logo1_.exe
1760	Logo1_.exe
1760	Logo1_.exe
1760	Logo1_.exe
1760	Logo1_.exe
1760	Logo1_.exe
1760	Logo1_.exe
1760	Logo1_.exe
1760	Logo1_.exe
1760	Logo1_.exe
1760	Logo1_.exe
1760	Logo1_.exe
1760	Logo1_.exe
1760	Logo1_.exe
1760	Logo1_.exe
1760	Logo1_.exe
1760	Logo1_.exe
1760	Logo1_.exe
1760	Logo1_.exe
1760	Logo1_.exe
1760	Logo1_.exe
1760	Logo1_.exe
1760	Logo1_.exe
1760	Logo1_.exe
1760	Logo1_.exe
1760	Logo1_.exe
1760	Logo1_.exe
1760	Logo1_.exe
1760	Logo1_.exe
1760	Logo1_.exe
1760	Logo1_.exe
1760	Logo1_.exe
1760	Logo1_.exe
1760	Logo1_.exe
1760	Logo1_.exe
1760	Logo1_.exe
2152	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
2152	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 412 wrote to memory of 5092	412	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe	80
PID 412 wrote to memory of 1760	412	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe	81
PID 1760 wrote to memory of 3532	1760	Logo1_.exe	83
PID 3532 wrote to memory of 2028	3532	net.exe	85
PID 5092 wrote to memory of 1176	5092	cmd.exe	87
PID 1176 wrote to memory of 4704	1176	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe	88
PID 4704 wrote to memory of 4520	4704	cmd.exe	90
PID 4520 wrote to memory of 2184	4520	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe	91
PID 2184 wrote to memory of 5096	2184	cmd.exe	93
PID 5096 wrote to memory of 2344	5096	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe	94
PID 2344 wrote to memory of 356	2344	cmd.exe	96
PID 356 wrote to memory of 1312	356	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe	97
PID 1312 wrote to memory of 5840	1312	cmd.exe	99
PID 5840 wrote to memory of 3520	5840	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe	100
PID 3520 wrote to memory of 2716	3520	cmd.exe	102
PID 2716 wrote to memory of 2476	2716	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe	103
PID 2476 wrote to memory of 2040	2476	cmd.exe	105
PID 2040 wrote to memory of 4432	2040	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe	106
PID 4432 wrote to memory of 6124	4432	cmd.exe	110
PID 6124 wrote to memory of 3756	6124	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe	111
PID 3756 wrote to memory of 2152	3756	cmd.exe	114
PID 2152 wrote to memory of 3600	2152	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe	115
PID 2152 wrote to memory of 4220	2152	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe	116
PID 4220 wrote to memory of 5844	4220	Logo1_.exe	118
PID 5844 wrote to memory of 4888	5844	net.exe	120
PID 3600 wrote to memory of 5276	3600	cmd.exe	121
PID 5276 wrote to memory of 2176	5276	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe	122
PID 2176 wrote to memory of 4332	2176	cmd.exe	124
PID 4332 wrote to memory of 4272	4332	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe	125
PID 4272 wrote to memory of 704	4272	cmd.exe	127
PID 704 wrote to memory of 3156	704	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe	128
PID 3156 wrote to memory of 1656	3156	cmd.exe	130
PID 1656 wrote to memory of 5024	1656	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe	131
PID 5024 wrote to memory of 4944	5024	cmd.exe	133
PID 4944 wrote to memory of 5544	4944	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe	134
PID 5544 wrote to memory of 4640	5544	cmd.exe	136
PID 4640 wrote to memory of 4696	4640	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe	137
PID 4696 wrote to memory of 244	4696	cmd.exe	139
PID 244 wrote to memory of 5888	244	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe	140
PID 5888 wrote to memory of 3008	5888	cmd.exe	142
PID 3008 wrote to memory of 4964	3008	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe	143
PID 4964 wrote to memory of 3224	4964	cmd.exe	145
PID 3224 wrote to memory of 4404	3224	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe	146
PID 4404 wrote to memory of 3816	4404	cmd.exe	148
PID 3816 wrote to memory of 4656	3816	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe	149
PID 4656 wrote to memory of 1168	4656	cmd.exe	151
PID 1168 wrote to memory of 3424	1168	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe	152
PID 3424 wrote to memory of 2172	3424	cmd.exe	154
PID 2172 wrote to memory of 3324	2172	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe	155
PID 3324 wrote to memory of 2804	3324	cmd.exe	157
PID 2804 wrote to memory of 3808	2804	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe	158
PID 3808 wrote to memory of 5076	3808	cmd.exe	160
PID 5076 wrote to memory of 3860	5076	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe	161
PID 3860 wrote to memory of 4692	3860	cmd.exe	163
PID 4692 wrote to memory of 5004	4692	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe	164
PID 5004 wrote to memory of 6068	5004	cmd.exe	166
PID 6068 wrote to memory of 5872	6068	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe	167
PID 5872 wrote to memory of 2512	5872	cmd.exe	169
PID 2512 wrote to memory of 2028	2512	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe	170
PID 2028 wrote to memory of 3148	2028	cmd.exe	172
PID 3148 wrote to memory of 4284	3148	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe	173
PID 4284 wrote to memory of 2536	4284	cmd.exe	175
PID 2536 wrote to memory of 4392	2536	10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe	176
PID 4392 wrote to memory of 2632	4392	cmd.exe	178

C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
"C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:412
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFA5E.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5092
- - C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
    "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1176
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFBB5.bat
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4704
    - - C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4520
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFD7A.bat
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2184
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5096
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFF30.bat
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:356
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1C0.bat
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:1312
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        11⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5840
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a422.bat
        12⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3520
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2716
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a673.bat
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        15⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:2040
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B5.bat
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:4432
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        17⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:6124
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB46.bat
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:3756
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        19⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2152
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE14.bat
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5276
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1151.bat
        22⤵
        Suspicious use of WriteProcessMemory
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        23⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4332
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a14CB.bat
        24⤵
        Suspicious use of WriteProcessMemory
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        25⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:704
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1875.bat
        26⤵
        Suspicious use of WriteProcessMemory
        
        PID:3156
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        27⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1656
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1B82.bat
        28⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        29⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4944
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1E9F.bat
        30⤵
        Suspicious use of WriteProcessMemory
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        31⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4640
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a213F.bat
        32⤵
        Suspicious use of WriteProcessMemory
        
        PID:4696
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        33⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:244
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a23FE.bat
        34⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        35⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3008
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a265F.bat
        36⤵
        Suspicious use of WriteProcessMemory
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        37⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:3224
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a28C1.bat
        38⤵
        Suspicious use of WriteProcessMemory
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        39⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3816
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2B60.bat
        40⤵
        Suspicious use of WriteProcessMemory
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        41⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1168
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2BBE.bat
        42⤵
        Suspicious use of WriteProcessMemory
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        43⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2172
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2C2C.bat
        44⤵
        Suspicious use of WriteProcessMemory
        
        PID:3324
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        45⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2804
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2C6A.bat
        46⤵
        Suspicious use of WriteProcessMemory
        
        PID:3808
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        47⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5076
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2CB8.bat
        48⤵
        Suspicious use of WriteProcessMemory
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        49⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:4692
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2D26.bat
        50⤵
        Suspicious use of WriteProcessMemory
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        51⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:6068
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2DC2.bat
        52⤵
        Suspicious use of WriteProcessMemory
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        53⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2512
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E6E.bat
        54⤵
        Suspicious use of WriteProcessMemory
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        55⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:3148
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2EDB.bat
        56⤵
        Suspicious use of WriteProcessMemory
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        57⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2536
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2F29.bat
        58⤵
        Suspicious use of WriteProcessMemory
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        59⤵
        Executes dropped EXE
        
        PID:2632
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2F87.bat
        60⤵
        
        PID:4108
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        61⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1380
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2FE5.bat
        62⤵
        
        PID:4320
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        63⤵
        Executes dropped EXE
        
        PID:3312
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3042.bat
        64⤵
        System Location Discovery: System Language Discovery
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        65⤵
        Executes dropped EXE
        
        PID:6108
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a30A0.bat
        66⤵
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        67⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:5628
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a30FE.bat
        68⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        69⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:6056
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a316B.bat
        70⤵
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        71⤵
        Executes dropped EXE
        
        PID:1440
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a31C9.bat
        72⤵
        System Location Discovery: System Language Discovery
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        73⤵
        Executes dropped EXE
        
        PID:3776
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3217.bat
        74⤵
        
        PID:1112
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        75⤵
        Executes dropped EXE
        
        PID:4268
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3275.bat
        76⤵
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        77⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:5284
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a32C3.bat
        78⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        79⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1420
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3311.bat
        80⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        81⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3232
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a336F.bat
        82⤵
        
        PID:1128
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        83⤵
        Executes dropped EXE
        
        PID:5252
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a33EC.bat
        84⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        85⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1860
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a343A.bat
        86⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        87⤵
        Executes dropped EXE
        
        PID:3572
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3498.bat
        88⤵
        
        PID:5088
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        89⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:924
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a34E6.bat
        90⤵
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        91⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1364
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3534.bat
        92⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        93⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1504
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a35B1.bat
        94⤵
        
        PID:4064
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        95⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4632
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a362E.bat
        96⤵
        
        PID:3508
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        97⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1340
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a36AB.bat
        98⤵
        System Location Discovery: System Language Discovery
        
        PID:124
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        99⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4860
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3709.bat
        100⤵
        System Location Discovery: System Language Discovery
        
        PID:1508
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        101⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5288
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3747.bat
        102⤵
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        103⤵
        Executes dropped EXE
        
        PID:1268
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3795.bat
        104⤵
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        105⤵
        Executes dropped EXE
        
        PID:1668
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a37E4.bat
        106⤵
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        107⤵
        Executes dropped EXE
        
        PID:2708
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3832.bat
        108⤵
        
        PID:2240
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        109⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4276
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3880.bat
        110⤵
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        111⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4040
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a38DE.bat
        112⤵
        System Location Discovery: System Language Discovery
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        113⤵
        Executes dropped EXE
        
        PID:4560
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a394B.bat
        114⤵
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        115⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4812
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3989.bat
        116⤵
        System Location Discovery: System Language Discovery
        
        PID:4720
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        117⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3892
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a39F7.bat
        118⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        119⤵
        Executes dropped EXE
        
        PID:5568
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3A55.bat
        120⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        121⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:576
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3A93.bat
        122⤵
        System Location Discovery: System Language Discovery
        
        PID:3028
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        123⤵
        Executes dropped EXE
        
        PID:3304
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3AD2.bat
        124⤵
        System Location Discovery: System Language Discovery
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        125⤵
        Executes dropped EXE
        
        PID:3676
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3B10.bat
        126⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        127⤵
        System Location Discovery: System Language Discovery
        
        PID:4372
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3B6E.bat
        128⤵
        
        PID:3180
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        129⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1736
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3BAC.bat
        130⤵
        
        PID:4032
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        131⤵
        
        PID:4248
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3BFA.bat
        132⤵
        
        PID:760
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        133⤵
        Drops file in Windows directory
        
        PID:1280
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3C58.bat
        134⤵
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        135⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3CA6.bat
        136⤵
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        137⤵
        Drops file in Windows directory
        
        PID:5336
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3CE5.bat
        138⤵
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        139⤵
        
        PID:4212
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3D33.bat
        140⤵
        
        PID:1936
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        141⤵
        
        PID:656
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3DC0.bat
        142⤵
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        143⤵
        Drops file in Windows directory
        
        PID:3284
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3E2D.bat
        144⤵
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        145⤵
        
        PID:2212
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3E7B.bat
        146⤵
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        147⤵
        
        PID:3300
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3EBA.bat
        148⤵
        
        PID:3056
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        149⤵
        
        PID:4412
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3F65.bat
        150⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        151⤵
        Drops file in Windows directory
        
        PID:3912
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3FA4.bat
        152⤵
        
        PID:1288
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        153⤵
        
        PID:4712
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3FF2.bat
        154⤵
        System Location Discovery: System Language Discovery
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        155⤵
        Drops file in Windows directory
        
        PID:4916
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4040.bat
        156⤵
        
        PID:272
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        157⤵
        
        PID:2828
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a408E.bat
        158⤵
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        159⤵
        
        PID:4400
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a40CD.bat
        160⤵
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        161⤵
        
        PID:1512
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a410B.bat
        162⤵
        
        PID:2372
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        163⤵
        System Location Discovery: System Language Discovery
        
        PID:5380
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4169.bat
        164⤵
        System Location Discovery: System Language Discovery
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        165⤵
        
        PID:4184
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a41A8.bat
        166⤵
        System Location Discovery: System Language Discovery
        
        PID:4024
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        167⤵
        
        PID:840
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4244.bat
        168⤵
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        169⤵
        
        PID:4768
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4292.bat
        170⤵
        
        PID:4792
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        171⤵
        Drops file in Windows directory
        
        PID:4492
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a42D0.bat
        172⤵
        System Location Discovery: System Language Discovery
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        173⤵
        Drops file in Windows directory
        
        PID:3612
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a430F.bat
        174⤵
        
        PID:444
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        175⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a433E.bat
        176⤵
        
        PID:4148
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        177⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:776
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a439C.bat
        178⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        179⤵
        Drops file in Windows directory
        
        PID:1132
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a43EA.bat
        180⤵
        
        PID:4152
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        181⤵
        Drops file in Windows directory
        
        PID:4000
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4438.bat
        182⤵
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        183⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4016
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4496.bat
        184⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        185⤵
        
        PID:4940
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4503.bat
        186⤵
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        187⤵
        Drops file in Windows directory
        
        PID:1356
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4580.bat
        188⤵
        
        PID:3476
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        189⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3940
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a45CE.bat
        190⤵
        
        PID:5272
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        191⤵
        
        PID:1716
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a462C.bat
        192⤵
        
        PID:3460
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        193⤵
        Drops file in Windows directory
        
        PID:1676
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a467A.bat
        194⤵
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        195⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a46C8.bat
        196⤵
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        197⤵
        
        PID:3360
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4726.bat
        198⤵
        
        PID:4864
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        199⤵
        System Location Discovery: System Language Discovery
        
        PID:3720
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4774.bat
        200⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        201⤵
        
        PID:3308
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a47C2.bat
        202⤵
        System Location Discovery: System Language Discovery
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        203⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a482F.bat
        204⤵
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        205⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a48CC.bat
        206⤵
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        207⤵
        Drops file in Windows directory
        
        PID:4076
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a490A.bat
        208⤵
        
        PID:1088
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        209⤵
        System Location Discovery: System Language Discovery
        
        PID:5260
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4978.bat
        210⤵
        
        PID:3660
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        211⤵
        Drops file in Windows directory
        
        PID:3164
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a49C6.bat
        212⤵
        
        PID:1036
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        213⤵
        Drops file in Windows directory
        
        PID:5736
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4A04.bat
        214⤵
        
        PID:3784
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        215⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2492
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4A52.bat
        216⤵
        
        PID:4232
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        217⤵
        System Location Discovery: System Language Discovery
        
        PID:4904
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4AB0.bat
        218⤵
        System Location Discovery: System Language Discovery
        
        PID:1100
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        219⤵
        System Location Discovery: System Language Discovery
        
        PID:3964
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4B0E.bat
        220⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        221⤵
        
        PID:848
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4B6C.bat
        222⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        223⤵
        Drops file in Windows directory
        
        PID:5644
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4BD9.bat
        224⤵
        System Location Discovery: System Language Discovery
        
        PID:3908
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        225⤵
        Drops file in Windows directory
        
        PID:804
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4C37.bat
        226⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        227⤵
        Drops file in Windows directory
        
        PID:4116
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4C94.bat
        228⤵
        
        PID:392
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        229⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4CE3.bat
        230⤵
        System Location Discovery: System Language Discovery
        
        PID:788
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        231⤵
        
        PID:4192
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4D21.bat
        232⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        233⤵
        
        PID:3392
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4D60.bat
        234⤵
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        235⤵
        
        PID:4416
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4DBD.bat
        236⤵
        System Location Discovery: System Language Discovery
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        237⤵
        System Location Discovery: System Language Discovery
        
        PID:3996
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4DEC.bat
        238⤵
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        239⤵
        
        PID:1108
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4E3A.bat
        240⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        241⤵
        System Location Discovery: System Language Discovery
        
        PID:5992
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4E98.bat
        242⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        243⤵
        
        PID:2900
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4ED7.bat
        244⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        245⤵
        System Location Discovery: System Language Discovery
        
        PID:3984
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4F05.bat
        246⤵
        
        PID:2200
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        247⤵
        System Location Discovery: System Language Discovery
        
        PID:4880
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4F63.bat
        248⤵
        
        PID:1780
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        249⤵
        
        PID:4748
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4FD1.bat
        250⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        251⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a500F.bat
        252⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        253⤵
        Drops file in Windows directory
        
        PID:220
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a509C.bat
        254⤵
        
        PID:3272
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        255⤵
        Drops file in Windows directory
        
        PID:5580
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5109.bat
        256⤵
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        257⤵
        Drops file in Windows directory
        
        PID:4648
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5148.bat
        258⤵
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        259⤵
        Drops file in Windows directory
        
        PID:2848
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5186.bat
        260⤵
        
        PID:4124
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        261⤵
        Drops file in Windows directory
        
        PID:4536
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a51D4.bat
        262⤵
        System Location Discovery: System Language Discovery
        
        PID:5052
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        263⤵
        
        PID:2876
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5242.bat
        264⤵
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        265⤵
        Drops file in Windows directory
        
        PID:960
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a529F.bat
        266⤵
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        267⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a52DE.bat
        268⤵
        System Location Discovery: System Language Discovery
        
        PID:1192
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        269⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a531C.bat
        270⤵
        
        PID:3948
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        271⤵
        
        PID:2940
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a536A.bat
        272⤵
        
        PID:1180
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        273⤵
        
        PID:3752
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a53A9.bat
        274⤵
        
        PID:2232
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        275⤵
        
        PID:1056
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a53F7.bat
        276⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        277⤵
        System Location Discovery: System Language Discovery
        
        PID:1060
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5436.bat
        278⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        279⤵
        
        PID:3656
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5484.bat
        280⤵
        
        PID:1888
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        281⤵
        
        PID:1560
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a54D2.bat
        282⤵
        
        PID:2956
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        283⤵
        
        PID:4796
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5510.bat
        284⤵
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        285⤵
        Drops file in Windows directory
        
        PID:5492
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a554F.bat
        286⤵
        
        PID:3184
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        287⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1436
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a55BC.bat
        288⤵
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        289⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a560A.bat
        290⤵
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        291⤵
        Drops file in Windows directory
        
        PID:2004
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5658.bat
        292⤵
        
        PID:2080
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        293⤵
        
        PID:4280
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a56A7.bat
        294⤵
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        295⤵
        
        PID:3136
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a56E5.bat
        296⤵
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        297⤵
        
        PID:1028
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5733.bat
        298⤵
        
        PID:620
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        299⤵
        Drops file in Windows directory
        
        PID:5792
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5791.bat
        300⤵
        System Location Discovery: System Language Discovery
        
        PID:1448
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        301⤵
        
        PID:4876
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a57DF.bat
        302⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        303⤵
        
        PID:2008
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a580E.bat
        304⤵
        System Location Discovery: System Language Discovery
        
        PID:3452
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        305⤵
        
        PID:3988
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a587B.bat
        306⤵
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        307⤵
        
        PID:652
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a58C9.bat
        308⤵
        System Location Discovery: System Language Discovery
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        309⤵
        System Location Discovery: System Language Discovery
        
        PID:4652
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5908.bat
        310⤵
        System Location Discovery: System Language Discovery
        
        PID:2064
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        311⤵
        
        PID:3344
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5966.bat
        312⤵
        
        PID:3256
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        313⤵
        
        PID:3588
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a59B4.bat
        314⤵
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        315⤵
        
        PID:3320
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5A02.bat
        316⤵
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        317⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5A6F.bat
        318⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        319⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2960
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5AAE.bat
        320⤵
        
        PID:4028
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        321⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5AFC.bat
        322⤵
        System Location Discovery: System Language Discovery
        
        PID:3812
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        323⤵
        Drops file in Windows directory
        
        PID:5212
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5B3A.bat
        324⤵
        
        PID:1064
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        325⤵
        
        PID:904
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5B69.bat
        326⤵
        System Location Discovery: System Language Discovery
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        327⤵
        
        PID:3000
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5BA8.bat
        328⤵
        System Location Discovery: System Language Discovery
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        329⤵
        Drops file in Windows directory
        
        PID:232
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5C15.bat
        330⤵
        
        PID:3716
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        331⤵
        System Location Discovery: System Language Discovery
        
        PID:5496
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5C63.bat
        332⤵
        
        PID:1344
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        333⤵
        System Location Discovery: System Language Discovery
        
        PID:5452
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5C92.bat
        334⤵
        System Location Discovery: System Language Discovery
        
        PID:1068
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        335⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5CD1.bat
        336⤵
        
        PID:1696
        
        C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10c814817209c2bf4de540341fc0f1ace67abef2d3543c148c7c3f2e94d1b52e.exe"
        337⤵
        
        PID:3200
        
        C:\Windows\Logo1_.exe
        
        C:\Windows\Logo1_.exe
        20⤵
        Executes dropped EXE
        Enumerates connected drives
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4220
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Kingsoft AntiVirus Service"
        21⤵
        Suspicious use of WriteProcessMemory
        
        PID:5844
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        22⤵
        
        PID:4888
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1760
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3532
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:2028
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 788
    3⤵
    - Program crash
    PID:5916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1760 -ip 1760
1⤵
PID:564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

$$a1151.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a1151.bat
Size 722B
SHA256 abb7589f2a4f08dc7c65531e3a4283367e71345c8f8e661c813a07f78bf35d6c
MD5 36165a102083f2a6d6b8818323ab4605
SHA1 bcd206b78445044c0e926da4c3790a3b2cba8b6f
SHA512 b682d629c51264b6a4f1f281455c88cda4a886988c1e3d9f46fd16fc1a30e028d5739f428bec3e0de049336335f603d89f5e995b6b661a633e9c89f4f4f311bb
TLSH
T1BC01D49342CBA24D0C94391BB97084CEECB55C893A8F2252A710B6CA27DB41CD6CF351
MD5 SHA1 SHA512 TLSH

Submit Download

$$a14CB.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a14CB.bat
Size 722B
SHA256 fd2ba60377a20e02f4f6ea5ce76eaf291060db8c1d9fdffd01bc181ae075347f
MD5 715376d6488b0338a8495e2fd6cd39ab
SHA1 2c891ed55d3b3b950f3765cd3f4bc7269740400c
SHA512 2935b9abad44e7c9458dd2c823802766c264583c94f2c5e1d70650a995759d0d008ca305e27fd31b8dfaff959677c5b2485a1c8e29780f299ac313be6ff11d5b
TLSH
T1FF01F7D342CBA24D0C94391BB97084CEECB55C883A8F2252B711B6CA27DB41CD6CF311
MD5 SHA1 SHA512 TLSH

Submit Download

$$a1875.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a1875.bat
Size 722B
SHA256 fc4109930f0478a02a7e758e2f0abc45a5ff71b7bc147510ecd7a7f646e4c64c
MD5 b7b532dd427eab8762197a6c33e0be79
SHA1 6fb2b85743a27dec603da75b4f28a58b7798ee03
SHA512 82191acbb098d7f1725551aa2f7303493773709ae8a21757959c2e4066d3b0c3982ec7e8ed1d46b9ec3481b99d7f5535f1995f064670888669c64b4ff5b655df
TLSH
T19601F7D342CBA24D0C94391BB97084CEECB55C883A8F2262B710B6CA27DB41CD6CF351
MD5 SHA1 SHA512 TLSH

Submit Download

$$a1B82.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a1B82.bat
Size 722B
SHA256 be6ce127a073c1adc405596577f14f172f163c15f6517d90aa6a1088733fbb06
MD5 5ca1daddda0310d72833043c946984ce
SHA1 5610c62e686c16b3bd362b41063f2f7202db35ed
SHA512 df57822cb12615043aca9ca451ae3197132b9e39c6bb5f294441a5ffcbeaf2fcd564219c7c8d5d3fab39896f257f1be435d66a91f79a127570fef8135f020283
TLSH
T18101D49342CBA24D0C94391BB97084CEECB55C883A8F2252A710B6CA27DB41CD6CF351
MD5 SHA1 SHA512 TLSH

Submit Download

$$a1C0.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a1C0.bat
Size 721B
SHA256 df275ec0e4683caf97b1931ed902e99ac469ccf92387293a513d3b5c067248cc
MD5 49912a375a871ae0b651211ff17167b6
SHA1 086139f28c881b100ffb3bbb0560dea96e6482ed
SHA512 0f9068f16a5f63e46d539fff20943eba3db4e59abeb253dc44a13af793ab8ecd9b3caa2dad6a689ed578d95284bc44a52dc3130367985c8241c4a65c98eeb635
TLSH
T16701A7D342CBA24D0C94791BB97084CEECB55C893A8F2252B715B6CA27DB41CD6DF351
MD5 SHA1 SHA512 TLSH

Submit Download

$$a1E9F.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a1E9F.bat
Size 722B
SHA256 2c0cf599da7885edff873b78cb454c8893fd7446c8333289e2edf7c3621a84a5
MD5 42f95c1e877f61f12a2072f4294f5d8b
SHA1 3e7c4be84e73dc92eec828f17ae84653221d9cee
SHA512 cff47a49ed26c47f9333a755daaa77819de73565ae757e52d86dc9f14593535c16995dd51e2e950aa1d7bfb7cc5dc14cab744f4ea4675265152658342c811600
TLSH
T16801D49342CBA24D0C94391BB97084CEECB55C893A8F2252A710B6CA27DB41CD6DF311
MD5 SHA1 SHA512 TLSH

Submit Download

$$a213F.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a213F.bat
Size 722B
SHA256 9fd829ec74e42a793eda9c462717c7bc6caf6225e821b06e50aa767fe4c2efe7
MD5 1ec492208effbcb2a9e211339e8e111b
SHA1 dd9ec2d63fd5dda33453a890fa6b5b73782ab509
SHA512 6bec68dffff6be3f671c398977668150972b23a89518847393e2dcd321567018642595d37becc9ec36a2ebc7cbca4a08cecd445011a8f4a4829679a8124ffc2b
TLSH
T16B0184D342CBA24D0C94791BB97084CEECB55C893A8F2252A715B6CA27DB41CD6DF351
MD5 SHA1 SHA512 TLSH

Submit Download

$$a23FE.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a23FE.bat
Size 722B
SHA256 4163c17cd112f0c1cd8e819873ce655fdbcd2449138779375ae9db86c3380692
MD5 73f271b54bcd225036e9a5f47623fe48
SHA1 1856d22d5049de6688ba735aea9555e529efef7b
SHA512 afc1640a34c48286b9927be4873cadc72b17713755b8f1dd34dd92f98ce806fa5a6770369a5c6d4afe1f58827a8db309735a00c5f1ba923d73e9289a5661ca39
TLSH
T1F401D49342CBA24D0C94391BB97084CEECB55C883A8F2262A711B6CA27DB41CD6CF311
MD5 SHA1 SHA512 TLSH

Submit Download

$$a265F.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a265F.bat
Size 722B
SHA256 975fffdd2131a2b20a289e4977d006a5ef950536d67399cd2f5aabf7e431c447
MD5 88ac9f22b201d4b84f285678b823b84b
SHA1 d82f6996762d6279dee146bf7695bd9a5965c86d
SHA512 439b2d2c986cb569f0f1fbe38f0de519393e89251ed00d795f99b49132994a8ab599452e5b76e5febfa5657f56d196e8646204f0c5e70994ec0098f77e70ad3c
TLSH
T12101F7D342CBA24D0C94391BB97084CEECB55C883A8F2292B714B6CA27EB41CD6DF311
MD5 SHA1 SHA512 TLSH

Submit Download

$$a422.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a422.bat
Size 721B
SHA256 a0d7d3554c2dbdd6a5b746f68dc4e547c11de26a1f05a2297f756ebfaa462f77
MD5 a9f5b0d6d3680eb585312f811e550e60
SHA1 b9fdf224800c034971c75017c9ecf173d65735c8
SHA512 e54d53c51341c87525d550b93cd8bd7a367f9a5c79433ce1f95416b56008c0a98a840892765242f69918b3ff2e274aa499193dafdafbb9ef706d3dd70cb43ba3
TLSH
T12801849342CBA24D0C94791BB97084CEECB55C893A8F2252A715B6CA27DB41CD6DF351
MD5 SHA1 SHA512 TLSH

Submit Download

$$a673.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a673.bat
Size 721B
SHA256 6403b81221de5adc257f725fb7e5696f59c30127c4bbcc8ede8297b648437c3f
MD5 7f8044d695c5356993b004a0b835d060
SHA1 bc13cf1fdc4d2ab6dace51305d93b1f4b6f2bfc3
SHA512 37c24d14e47505cc0ac877d07bbfae617a215b81bac75333c0d1b49ee81a242d45252089088a67f799c53eb978c09247070ad0b20fc86b85811ad246c7c3d00e
TLSH
T12601F7D342CBA24D0C94391BB97084CEECB55C883A8F2252B710B6CA27EB41CD6DF311
MD5 SHA1 SHA512 TLSH

Submit Download

$$a8B5.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a8B5.bat
Size 721B
SHA256 de09f685a92933feebe3a6f230309d42bba957f030ffe58354c84ab92a2faa13
MD5 747015a0166b3ce7966143e941ee5211
SHA1 a2be2fc0603cf1ae46cd1ddbede438ea75feebcf
SHA512 bd6929e70d61d146d44ab0b4a682597fc45b2d69bef0b6c11bbd07e4276ef49b7a4eb44238e9bdca3212897c2fc0c45fa5f130e525772016bada3cdd1957f6d9
TLSH
T1D301D49342CBA24D0C94391BB97084CEECB55C883A8F2252A710B6CA27DB42CD6DF351
MD5 SHA1 SHA512 TLSH

Submit Download

$$aB46.bat

Path C:\Users\Admin\AppData\Local\Temp\$$aB46.bat
Size 721B
SHA256 51ec8973c917fbc6597e37b30c50edecfc4373a1c00b187e59376e3831a64931
MD5 8690c1fa99fe880d5633c861fd25087a
SHA1 d6aaa2cd15e693a12dc4642a689bfb071332a514
SHA512 b6aded180ca38a42a86a8abb527a5183d4aa5b40342ed22a3e26f2676366af40163d2fc5c9d2eb60407f6977510de49c8b7f7c9a3acf95b0a2f33ca0b4c26d5e
TLSH
T1E001D49342CBA24D0C94391BB97084CEECB55C883A8F2252A711B6CA27DB41CD6CF311
MD5 SHA1 SHA512 TLSH

Submit Download

$$aE14.bat

Path C:\Users\Admin\AppData\Local\Temp\$$aE14.bat
Size 721B
SHA256 b77538bd90a6c9783d849490fb2bfc6980e042d7a0519439f426264e28452edd
MD5 049b4f5910b770aedd57814251fec7e5
SHA1 826dba14be94489b84e67f4189345c4f6c81bb46
SHA512 10f9bca556b3fdf6bb490c9ca636bda8464c96cb1db365ff29b7858d50d54d68f9093ab0e838fa54c7d5278edb74732250dc36dbd495c667588ae7b0a29db6b2
TLSH
T11F01849342CBA24D0C94791BB97084CEECB55C893A8F2252A715B6CA27DB41CD6DF351
MD5 SHA1 SHA512 TLSH

Submit Download

$$aFA5E.bat

Path C:\Users\Admin\AppData\Local\Temp\$$aFA5E.bat
Size 722B
SHA256 90cbdf806611dc8efadb8e2d98f4b21e21a817bf84084faab2551ba9e1b3666c
MD5 3254d22262052cd60d885401a09e3a91
SHA1 fb97492f559d71400a419a71fcf12e62c89bfffc
SHA512 62d28d24d8ef1ae3476150310a0af38f43a859841d1352f8828b34c183fbdf81c2e84e6b78adff379c438d392b57168e015e595999fbc26900b0d0917a9cf94d
TLSH
T14301D49342CBA24D0C94391BB97084CEECB55C883A8F2262B711B6CA27DB41CD6CF311
MD5 SHA1 SHA512 TLSH

Submit Download

$$aFBB5.bat

Path C:\Users\Admin\AppData\Local\Temp\$$aFBB5.bat
Size 722B
SHA256 a251e0d54b7d1ea1d50b980d3eebb399f18d421c0034ef16cacbdcdafe290896
MD5 9e12b29f114f39a34900dbdfe4f7c878
SHA1 787d1a5b3e9aa2839ac5b89eaab1d7a7aa684b94
SHA512 0138b7445dd9b193245d7fa7a3c954ea8a26924f03750ce1bab77232ec30ed0afc6c8dc8a7e5daa60cf1a9c500c0e5af1720ac234e1493ef8766bf08683e2912
TLSH
T19501F7D342CBA24D0C94791BB97084CEECB55C883A8F2252B710B6CA27DB41CD6DF351
MD5 SHA1 SHA512 TLSH

Submit Download

$$aFD7A.bat

Path C:\Users\Admin\AppData\Local\Temp\$$aFD7A.bat
Size 722B
SHA256 ac1e92c8b3d5345a304785f15a33d32aadf38576878b065beb17dbc4eda23e1b
MD5 1dad62ff68b0747f6da098fa4ee3b761
SHA1 eafe49ebaee186bf20cc06ac406541097f948104
SHA512 15345470eeff1e45137cb9fa58ecf68957f7e5a35bb0f03d9532079769e13bf6381cea4d60f1e5c95a98c320747b8e1f6ac7674289dfd916005c0b2a63195012
TLSH
T10B01D49342CBA24D0C94391BB97084CEECB55C883A8F2252A710B6CA37DB41CD6CF351
MD5 SHA1 SHA512 TLSH

Submit Download

$$aFF30.bat

Path C:\Users\Admin\AppData\Local\Temp\$$aFF30.bat
Size 722B
SHA256 2e98fab8c50e2ba28e8971e279eea78888310f29541a5d0a8f9b12aab334b730
MD5 8a76ab180ff9f245029dd90b62709f99
SHA1 307a2d8fc11e270d1fc7d69cfe73134ffa1b42cc
SHA512 11132739f32e885a09a57f40fdd44d85ff2878d3f8f9459d0b37a0ad609afc2e387310b224ff52453659b7b44e41304dd485a618140b51657ef07528b5907a5d
TLSH
T17901F7D342CBA24D0C94391BB97084CEECB55C883A8F2252B710B6CA27DB42CD6DF311
MD5 SHA1 SHA512 TLSH

Submit Download