3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c

Analysis

max time kernel
149s
max time network
156s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 19:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
Size 5.4MB
Sample260601-x2caaafs6r
SHA256 3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c
MD5 818a710a1160cf9095fb13204f71cedb
SHA1 d883853401123e06c22d93fb1ebe68748f28c859
SHA512 093886062a4d645f5858e40b02d56c3ec4a64eb6aaea5f8cfb496faae00a2a8c112f9b7ba518c0dccab57bbc46580c9be7ada5668277266e11a023c429bc731a
SSDEEP 98304:iLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLP:CjJl
TLSH
T17C46E08193D9A479E5C3163450B38FCBE7697461E7218B4F906402FDEDC02E5AE2AFB4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
6088	Logo1_.exe
3500	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
848	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
2680	Logo1_.exe
2404	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
5680	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
1680	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
3608	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
4596	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
2256	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
2272	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
4140	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
1380	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
4144	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
552	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
1308	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
5384	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
1056	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
3920	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
1248	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
5692	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
2316	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
3504	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
4856	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
5728	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
5984	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
6044	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
4888	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
5056	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
3416	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
5656	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
668	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
4832	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
1948	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
72	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
3212	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
3492	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
5464	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
1052	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
2788	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
5580	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
4908	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
1928	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
3152	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
4000	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
1828	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
4044	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
3620	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
5320	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
5164	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
2684	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
4448	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
3700	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
5192	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
1880	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
1464	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
5104	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
4620	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
5012	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
2244	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
5032	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
2180	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
2076	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
900	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe

Enumerates connected drives 3 TTPs 42 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File created	C:\Windows\Dll.dll	Logo1_.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File created	C:\Windows\Dll.dll	Logo1_.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
File created	C:\Windows\Logo1_.exe	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4376	6088	WerFault.exe	84
4136	6088	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5024	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
5024	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
5024	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
5024	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
5024	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
5024	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
5024	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
5024	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
5024	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
5024	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
5024	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
5024	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
5024	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
5024	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
5024	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
5024	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
5024	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
5024	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
6088	Logo1_.exe
6088	Logo1_.exe
6088	Logo1_.exe
6088	Logo1_.exe
6088	Logo1_.exe
6088	Logo1_.exe
6088	Logo1_.exe
6088	Logo1_.exe
6088	Logo1_.exe
6088	Logo1_.exe
6088	Logo1_.exe
6088	Logo1_.exe
6088	Logo1_.exe
6088	Logo1_.exe
6088	Logo1_.exe
6088	Logo1_.exe
6088	Logo1_.exe
6088	Logo1_.exe
6088	Logo1_.exe
6088	Logo1_.exe
6088	Logo1_.exe
6088	Logo1_.exe
6088	Logo1_.exe
6088	Logo1_.exe
6088	Logo1_.exe
6088	Logo1_.exe
6088	Logo1_.exe
6088	Logo1_.exe
6088	Logo1_.exe
6088	Logo1_.exe
6088	Logo1_.exe
6088	Logo1_.exe
6088	Logo1_.exe
6088	Logo1_.exe
6088	Logo1_.exe
6088	Logo1_.exe
6088	Logo1_.exe
6088	Logo1_.exe
6088	Logo1_.exe
6088	Logo1_.exe
6088	Logo1_.exe
6088	Logo1_.exe
6088	Logo1_.exe
6088	Logo1_.exe
848	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
848	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 2476	5024	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe	82
PID 5024 wrote to memory of 6088	5024	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe	84
PID 6088 wrote to memory of 792	6088	Logo1_.exe	85
PID 792 wrote to memory of 2012	792	net.exe	87
PID 2476 wrote to memory of 3500	2476	cmd.exe	88
PID 3500 wrote to memory of 5184	3500	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe	89
PID 5184 wrote to memory of 848	5184	cmd.exe	96
PID 848 wrote to memory of 4760	848	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe	97
PID 848 wrote to memory of 2680	848	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe	98
PID 2680 wrote to memory of 2612	2680	Logo1_.exe	100
PID 2612 wrote to memory of 3264	2612	net.exe	102
PID 4760 wrote to memory of 2404	4760	cmd.exe	103
PID 2404 wrote to memory of 1084	2404	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe	104
PID 1084 wrote to memory of 5680	1084	cmd.exe	106
PID 5680 wrote to memory of 4520	5680	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe	107
PID 4520 wrote to memory of 1680	4520	cmd.exe	109
PID 1680 wrote to memory of 3056	1680	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe	110
PID 3056 wrote to memory of 3608	3056	cmd.exe	112
PID 3608 wrote to memory of 5608	3608	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe	113
PID 5608 wrote to memory of 4596	5608	cmd.exe	115
PID 4596 wrote to memory of 5288	4596	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe	116
PID 5288 wrote to memory of 2256	5288	cmd.exe	118
PID 2256 wrote to memory of 5432	2256	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe	119
PID 5432 wrote to memory of 2272	5432	cmd.exe	121
PID 2272 wrote to memory of 4124	2272	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe	122
PID 4124 wrote to memory of 4140	4124	cmd.exe	124
PID 4140 wrote to memory of 6052	4140	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe	125
PID 6052 wrote to memory of 1380	6052	cmd.exe	127
PID 1380 wrote to memory of 1780	1380	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe	128
PID 1780 wrote to memory of 4144	1780	cmd.exe	130
PID 4144 wrote to memory of 5596	4144	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe	131
PID 5596 wrote to memory of 552	5596	cmd.exe	133
PID 552 wrote to memory of 4440	552	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe	134
PID 4440 wrote to memory of 1308	4440	cmd.exe	136
PID 1308 wrote to memory of 3732	1308	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe	137
PID 3732 wrote to memory of 5384	3732	cmd.exe	139
PID 5384 wrote to memory of 3796	5384	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe	140
PID 3796 wrote to memory of 1056	3796	cmd.exe	142
PID 1056 wrote to memory of 5360	1056	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe	143
PID 5360 wrote to memory of 3920	5360	cmd.exe	145
PID 3920 wrote to memory of 5420	3920	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe	146
PID 5420 wrote to memory of 1248	5420	cmd.exe	148
PID 1248 wrote to memory of 2164	1248	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe	149
PID 2164 wrote to memory of 5692	2164	cmd.exe	151
PID 5692 wrote to memory of 6080	5692	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe	152
PID 6080 wrote to memory of 2316	6080	cmd.exe	154
PID 2316 wrote to memory of 4228	2316	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe	155
PID 4228 wrote to memory of 3504	4228	cmd.exe	157
PID 3504 wrote to memory of 4752	3504	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe	158
PID 4752 wrote to memory of 4856	4752	cmd.exe	160
PID 4856 wrote to memory of 6012	4856	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe	161
PID 6012 wrote to memory of 5728	6012	cmd.exe	163
PID 5728 wrote to memory of 4916	5728	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe	164
PID 4916 wrote to memory of 5984	4916	cmd.exe	166
PID 5984 wrote to memory of 4304	5984	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe	167
PID 4304 wrote to memory of 6044	4304	cmd.exe	169
PID 6044 wrote to memory of 2856	6044	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe	170
PID 2856 wrote to memory of 4888	2856	cmd.exe	172
PID 4888 wrote to memory of 5468	4888	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe	173
PID 5468 wrote to memory of 5056	5468	cmd.exe	175
PID 5056 wrote to memory of 3312	5056	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe	176
PID 3312 wrote to memory of 3416	3312	cmd.exe	178
PID 3416 wrote to memory of 5472	3416	3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe	179
PID 5472 wrote to memory of 5656	5472	cmd.exe	181

C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
"C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a17B9.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2476
- - C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
    "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3500
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a18B3.bat
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5184
    - - C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:848
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2B32.bat
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:2404
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3033.bat
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:1084
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        9⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:5680
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3498.bat
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        11⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1680
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a392C.bat
        12⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3056
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3608
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3CF4.bat
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4596
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a410B.bat
        16⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2256
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4541.bat
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2272
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4968.bat
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:4124
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4140
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4D11.bat
        22⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        23⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1380
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a50AB.bat
        24⤵
        Suspicious use of WriteProcessMemory
        
        PID:1780
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        25⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4144
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a538A.bat
        26⤵
        Suspicious use of WriteProcessMemory
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        27⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:552
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5697.bat
        28⤵
        Suspicious use of WriteProcessMemory
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        29⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1308
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5908.bat
        30⤵
        Suspicious use of WriteProcessMemory
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        31⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:5384
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5B98.bat
        32⤵
        Suspicious use of WriteProcessMemory
        
        PID:3796
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        33⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1056
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5E48.bat
        34⤵
        Suspicious use of WriteProcessMemory
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        35⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:3920
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6099.bat
        36⤵
        Suspicious use of WriteProcessMemory
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        37⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1248
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a62CC.bat
        38⤵
        Suspicious use of WriteProcessMemory
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        39⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5692
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a64D0.bat
        40⤵
        Suspicious use of WriteProcessMemory
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        41⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2316
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a656C.bat
        42⤵
        Suspicious use of WriteProcessMemory
        
        PID:4228
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        43⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:3504
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a65BA.bat
        44⤵
        Suspicious use of WriteProcessMemory
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        45⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4856
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6608.bat
        46⤵
        Suspicious use of WriteProcessMemory
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        47⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5728
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6685.bat
        48⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        49⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5984
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6741.bat
        50⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        51⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:6044
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a67DD.bat
        52⤵
        Suspicious use of WriteProcessMemory
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        53⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4888
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6898.bat
        54⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        55⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5056
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6925.bat
        56⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3312
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        57⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3416
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a69A2.bat
        58⤵
        Suspicious use of WriteProcessMemory
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        59⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5656
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6A1F.bat
        60⤵
        
        PID:3456
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        61⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:668
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6A9C.bat
        62⤵
        System Location Discovery: System Language Discovery
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        63⤵
        Executes dropped EXE
        
        PID:4832
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6AFA.bat
        64⤵
        
        PID:4840
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        65⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1948
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6B77.bat
        66⤵
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        67⤵
        Executes dropped EXE
        
        PID:72
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6BD4.bat
        68⤵
        
        PID:2848
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        69⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3212
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6C23.bat
        70⤵
        System Location Discovery: System Language Discovery
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        71⤵
        Executes dropped EXE
        
        PID:3492
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6C80.bat
        72⤵
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        73⤵
        Executes dropped EXE
        
        PID:5464
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6CDE.bat
        74⤵
        
        PID:1552
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        75⤵
        Executes dropped EXE
        
        PID:1052
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6D2C.bat
        76⤵
        
        PID:1788
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        77⤵
        Executes dropped EXE
        
        PID:2788
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6D8A.bat
        78⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        79⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:5580
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6DF7.bat
        80⤵
        
        PID:992
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        81⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4908
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6E55.bat
        82⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        83⤵
        Executes dropped EXE
        
        PID:1928
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6EF1.bat
        84⤵
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        85⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3152
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6F3F.bat
        86⤵
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        87⤵
        Executes dropped EXE
        
        PID:4000
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6F9D.bat
        88⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        89⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1828
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6FFB.bat
        90⤵
        
        PID:3768
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        91⤵
        Executes dropped EXE
        
        PID:4044
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7059.bat
        92⤵
        
        PID:3948
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        93⤵
        Executes dropped EXE
        
        PID:3620
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a70B6.bat
        94⤵
        
        PID:3756
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        95⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:5320
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7105.bat
        96⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        97⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:5164
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7143.bat
        98⤵
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        99⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2684
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a71B0.bat
        100⤵
        
        PID:3376
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        101⤵
        Executes dropped EXE
        
        PID:4448
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a71FF.bat
        102⤵
        
        PID:2772
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        103⤵
        Executes dropped EXE
        
        PID:3700
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a725C.bat
        104⤵
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        105⤵
        Executes dropped EXE
        
        PID:5192
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a729B.bat
        106⤵
        System Location Discovery: System Language Discovery
        
        PID:3140
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        107⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1880
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a72F9.bat
        108⤵
        System Location Discovery: System Language Discovery
        
        PID:1032
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        109⤵
        Executes dropped EXE
        
        PID:1464
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7366.bat
        110⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        111⤵
        Executes dropped EXE
        
        PID:5104
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a73D3.bat
        112⤵
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        113⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4620
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7431.bat
        114⤵
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        115⤵
        Executes dropped EXE
        
        PID:5012
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a749E.bat
        116⤵
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        117⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2244
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a74FC.bat
        118⤵
        
        PID:3788
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        119⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:5032
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a755A.bat
        120⤵
        System Location Discovery: System Language Discovery
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        121⤵
        Executes dropped EXE
        
        PID:2180
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a75B8.bat
        122⤵
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        123⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2076
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7635.bat
        124⤵
        
        PID:460
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        125⤵
        Executes dropped EXE
        
        PID:900
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7692.bat
        126⤵
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        127⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2780
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a76F0.bat
        128⤵
        System Location Discovery: System Language Discovery
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        129⤵
        Drops file in Windows directory
        
        PID:4500
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a774E.bat
        130⤵
        
        PID:2188
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        131⤵
        
        PID:3180
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a779C.bat
        132⤵
        
        PID:3280
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        133⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7819.bat
        134⤵
        
        PID:324
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        135⤵
        
        PID:1648
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7886.bat
        136⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        137⤵
        
        PID:3068
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a78F4.bat
        138⤵
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        139⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7952.bat
        140⤵
        
        PID:4104
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        141⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4028
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a79AF.bat
        142⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        143⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A0D.bat
        144⤵
        
        PID:2464
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        145⤵
        
        PID:3556
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A5B.bat
        146⤵
        
        PID:4128
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        147⤵
        Drops file in Windows directory
        
        PID:2932
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7AB9.bat
        148⤵
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        149⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5672
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7B17.bat
        150⤵
        System Location Discovery: System Language Discovery
        
        PID:3852
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        151⤵
        
        PID:356
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7B65.bat
        152⤵
        System Location Discovery: System Language Discovery
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        153⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4848
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7BE2.bat
        154⤵
        
        PID:2292
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        155⤵
        
        PID:556
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7C4F.bat
        156⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        157⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7CBD.bat
        158⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        159⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1416
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7D0B.bat
        160⤵
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        161⤵
        
        PID:2956
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7D78.bat
        162⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        163⤵
        
        PID:1120
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7DE5.bat
        164⤵
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        165⤵
        
        PID:4712
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E34.bat
        166⤵
        
        PID:1096
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        167⤵
        Drops file in Windows directory
        
        PID:3156
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7EB1.bat
        168⤵
        
        PID:4132
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        169⤵
        
        PID:4224
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7F0E.bat
        170⤵
        System Location Discovery: System Language Discovery
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        171⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7F6C.bat
        172⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        173⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:6068
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8028.bat
        174⤵
        
        PID:3536
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        175⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4176
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8066.bat
        176⤵
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        177⤵
        Drops file in Windows directory
        
        PID:3800
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8102.bat
        178⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        179⤵
        
        PID:4692
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a817F.bat
        180⤵
        
        PID:1776
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        181⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a81ED.bat
        182⤵
        System Location Discovery: System Language Discovery
        
        PID:1816
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        183⤵
        
        PID:2968
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a824A.bat
        184⤵
        
        PID:1524
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        185⤵
        
        PID:944
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8299.bat
        186⤵
        System Location Discovery: System Language Discovery
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        187⤵
        Drops file in Windows directory
        
        PID:752
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a82F6.bat
        188⤵
        
        PID:1844
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        189⤵
        
        PID:1856
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8344.bat
        190⤵
        
        PID:648
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        191⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8393.bat
        192⤵
        
        PID:4032
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        193⤵
        Drops file in Windows directory
        
        PID:1636
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a83F0.bat
        194⤵
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        195⤵
        Drops file in Windows directory
        
        PID:5436
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a842F.bat
        196⤵
        System Location Discovery: System Language Discovery
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        197⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5560
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a847D.bat
        198⤵
        
        PID:816
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        199⤵
        Drops file in Windows directory
        
        PID:5276
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a84CB.bat
        200⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        201⤵
        
        PID:240
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8529.bat
        202⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        203⤵
        Drops file in Windows directory
        
        PID:4668
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8587.bat
        204⤵
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        205⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1528
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a85F4.bat
        206⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        207⤵
        
        PID:3352
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8661.bat
        208⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        209⤵
        
        PID:4608
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a86BF.bat
        210⤵
        System Location Discovery: System Language Discovery
        
        PID:2296
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        211⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a871D.bat
        212⤵
        
        PID:4704
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        213⤵
        
        PID:4956
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a878A.bat
        214⤵
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        215⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a87F8.bat
        216⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        217⤵
        System Location Discovery: System Language Discovery
        
        PID:5052
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8846.bat
        218⤵
        System Location Discovery: System Language Discovery
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        219⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a88F2.bat
        220⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        221⤵
        Drops file in Windows directory
        
        PID:4696
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a894F.bat
        222⤵
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        223⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a89DC.bat
        224⤵
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        225⤵
        Drops file in Windows directory
        
        PID:4632
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A3A.bat
        226⤵
        
        PID:3648
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        227⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A88.bat
        228⤵
        
        PID:1016
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        229⤵
        
        PID:2140
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B24.bat
        230⤵
        
        PID:1192
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        231⤵
        System Location Discovery: System Language Discovery
        
        PID:5124
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B72.bat
        232⤵
        System Location Discovery: System Language Discovery
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        233⤵
        
        PID:1768
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8BC0.bat
        234⤵
        
        PID:1808
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        235⤵
        Drops file in Windows directory
        
        PID:2044
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C0E.bat
        236⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        237⤵
        
        PID:4512
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C5D.bat
        238⤵
        
        PID:1036
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        239⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:6104
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8CBA.bat
        240⤵
        System Location Discovery: System Language Discovery
        
        PID:3516
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        241⤵
        
        PID:2336
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8CF9.bat
        242⤵
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        243⤵
        Drops file in Windows directory
        
        PID:824
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D57.bat
        244⤵
        System Location Discovery: System Language Discovery
        
        PID:2060
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        245⤵
        Drops file in Windows directory
        
        PID:2280
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D95.bat
        246⤵
        
        PID:724
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        247⤵
        Drops file in Windows directory
        
        PID:2988
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8DE3.bat
        248⤵
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        249⤵
        Drops file in Windows directory
        
        PID:5284
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E41.bat
        250⤵
        System Location Discovery: System Language Discovery
        
        PID:128
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        251⤵
        
        PID:3236
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E8F.bat
        252⤵
        
        PID:3148
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        253⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4844
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8EDD.bat
        254⤵
        
        PID:3624
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        255⤵
        
        PID:2092
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F2B.bat
        256⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        257⤵
        Drops file in Windows directory
        
        PID:2300
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F6A.bat
        258⤵
        
        PID:2172
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        259⤵
        
        PID:4584
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8FB8.bat
        260⤵
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        261⤵
        System Location Discovery: System Language Discovery
        
        PID:3804
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9006.bat
        262⤵
        
        PID:1604
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        263⤵
        Drops file in Windows directory
        
        PID:1432
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9064.bat
        264⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        265⤵
        Drops file in Windows directory
        
        PID:4900
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a90B2.bat
        266⤵
        
        PID:5064
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        267⤵
        
        PID:4320
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9100.bat
        268⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        269⤵
        System Location Discovery: System Language Discovery
        
        PID:2892
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a915E.bat
        270⤵
        
        PID:4156
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        271⤵
        
        PID:3992
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a91BC.bat
        272⤵
        
        PID:2828
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        273⤵
        
        PID:1628
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9229.bat
        274⤵
        
        PID:4212
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        275⤵
        Drops file in Windows directory
        
        PID:6096
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9287.bat
        276⤵
        System Location Discovery: System Language Discovery
        
        PID:1724
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        277⤵
        
        PID:4912
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a92D5.bat
        278⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        279⤵
        Drops file in Windows directory
        
        PID:4492
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9333.bat
        280⤵
        
        PID:2504
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        281⤵
        System Location Discovery: System Language Discovery
        
        PID:5616
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a93B0.bat
        282⤵
        
        PID:3388
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        283⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:480
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a940D.bat
        284⤵
        
        PID:420
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        285⤵
        System Location Discovery: System Language Discovery
        
        PID:5796
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a945B.bat
        286⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        287⤵
        
        PID:4484
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a94B9.bat
        288⤵
        
        PID:1804
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        289⤵
        Drops file in Windows directory
        
        PID:4088
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a94F8.bat
        290⤵
        System Location Discovery: System Language Discovery
        
        PID:1268
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        291⤵
        
        PID:3752
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9546.bat
        292⤵
        System Location Discovery: System Language Discovery
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        293⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a95B3.bat
        294⤵
        
        PID:2216
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        295⤵
        Drops file in Windows directory
        
        PID:5488
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9611.bat
        296⤵
        
        PID:1068
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        297⤵
        Drops file in Windows directory
        
        PID:1448
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a967E.bat
        298⤵
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        299⤵
        
        PID:4644
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a96CC.bat
        300⤵
        
        PID:1320
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        301⤵
        
        PID:4160
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a972A.bat
        302⤵
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        303⤵
        
        PID:3232
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9769.bat
        304⤵
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        305⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1740
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a97C6.bat
        306⤵
        System Location Discovery: System Language Discovery
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        307⤵
        Drops file in Windows directory
        
        PID:4376
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9805.bat
        308⤵
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        309⤵
        Drops file in Windows directory
        
        PID:4180
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9872.bat
        310⤵
        
        PID:1116
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        311⤵
        Drops file in Windows directory
        
        PID:2120
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a98D0.bat
        312⤵
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe"
        313⤵
        
        PID:1544
      - C:\Windows\Logo1_.exe
        
        C:\Windows\Logo1_.exe
        6⤵
        Executes dropped EXE
        Enumerates connected drives
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2680
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Kingsoft AntiVirus Service"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2612
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3264
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:6088
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:792
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:2012
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6088 -s 812
    3⤵
    - Program crash
    PID:4376
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6088 -s 1020
    3⤵
    - Program crash
    PID:4136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 6088 -ip 6088
1⤵
PID:5656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 6088 -ip 6088
1⤵
PID:5060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

$$a17B9.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a17B9.bat
Size 722B
SHA256 c223471230fdbef0029e01a16773129a6b5957cd59450653fb2af1073ff9d362
MD5 df008cf5dfcbef23551d5d89fc820ac4
SHA1 f93a6caaf01dbca23606b57f6cf5b582213c3bbb
SHA512 ea945c17124d1a2273e198f2977b9c27eb15c97f2d797d289aa2c2ce5fb0a78b6867d6ccf5d7107996a611b85451c6449c9b814eb570104e26f8cf1244d9446a
TLSH
T1260128C0E3E7EB3A4DCD114644206E0EC0FB0CB97A8613618B4EBC4C6342E1BE9E1745
MD5 SHA1 SHA512 TLSH

Submit Download

$$a18B3.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a18B3.bat
Size 722B
SHA256 0ff536a6769ebf0fb1395780496a158349b0c888cc02a10ec6edf32b678168d4
MD5 050c0428fc68477ac269d9968beaf570
SHA1 70357039152a3ea36b2db96bbdc069d0c1ed315e
SHA512 b1a5b898f87aee0b3c883310bee3789671e078aa20a5c8d1eb1436bf36be845c6a5fe401925db4ec74111f0e1d49b1b6e48d20846221bd47433d8926648b33c4
TLSH
T1CA012880E3E7EB3A4DCD114644206E0EC0FB0CB97A8613618B4DBC4C6342E1BE9E1745
MD5 SHA1 SHA512 TLSH

Submit Download

$$a2B32.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a2B32.bat
Size 722B
SHA256 35ae674476e3916b73aaf97b3ed25eba02d9d33faa5be6ee800f60be1123015c
MD5 2c5e5c7235fad7e3c8e6b634ebd8f028
SHA1 8d748577d57d0ecc0692f61c7020ae688adfbf9c
SHA512 5b4af002a2945e358c0c5fba618d252089b09040d07f188eaa48f0ee07be2774a5eecb135dc5bf6918fcb1186bf529ca997facf6957b263171d5e1b1c661de2e
TLSH
T1AB012880E3E7EB7A4DCD114644606E0EC0FB0CB97A8613618B4DBC4C6342E1BE9E1785
MD5 SHA1 SHA512 TLSH

Submit Download

$$a3033.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a3033.bat
Size 722B
SHA256 6381282d4e5f19139d7b78f86e0ff929b615e169a7b12b35eb26a7d81db874a3
MD5 19e90fca2da9e3bf7f4b4a9ebb778a2c
SHA1 328734e5e4725f161b2c49878ce4aaf54cf4a4a3
SHA512 32fdeef2b6345797825d470fb2cdd1e957910899c81f846b8c9dddc1f6064c967fa2ad431ee36188b388b9d7ac780753b703b63dc63268cb95f37769d7cb35fd
TLSH
T176012880E3E7EB3A4DCD114644606E0FC0FB0CB97A8613618B4EBC4C6342E1BE9E1745
MD5 SHA1 SHA512 TLSH

Submit Download

$$a3498.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a3498.bat
Size 722B
SHA256 4c8c1851f6700167d60483d787a3d5ddfee660c2cbc39f129155a0f7f449811a
MD5 b6d93533281cca5b056a1e817b5cccd1
SHA1 80155db1a767107976d7d520b2503fc6b962cf62
SHA512 a263e2b8b4e5def4900fe042d04c388fa2dbf65decd326f1fba0c46c1eb9592a4165f4f13b5b6706b2be00d86ca153a4ad3eb787555311b3be9fd984e4c4666e
TLSH
T17A01F580A3E7EB3A4DCD114644206E0EC0FB0CBA7A8613618B49BC4C6342E1AEAE1745
MD5 SHA1 SHA512 TLSH

Submit Download

$$a392C.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a392C.bat
Size 722B
SHA256 37c396b2d4741d086bfb5fb237138412407e1e30d2f939fb80c2ffb20484ae89
MD5 49b7e6883ecf49cad609fa8bf630557c
SHA1 3aefb4904f82ef40e09ff79b0e1b845fd3af62d4
SHA512 1618bdb4830e59ebe1c22aa05f44c56ffc221066dbdcad73383f527e479522a88f0f49b1c3c92df936eb5e4437933d42f6e7692206759149ab2b5f1302d36752
TLSH
T11601F580A3E7EB7A4DCD114644206E0EC0FB0CB97A8613618B59BC4C6342E1AE9E1745
MD5 SHA1 SHA512 TLSH

Submit Download

$$a3CF4.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a3CF4.bat
Size 722B
SHA256 5aa301206567a34fcfb13b74ee462a3c2551ec31bdb75604e14bbf1a187bd6cc
MD5 25d5dfdf4c7453de80a3bdc640bb227c
SHA1 16220f7cef742505f96993a660c077504ade2e0c
SHA512 b49c9f68388fbe5fed5b222c206875a0d04381e6034a77ba49f613fce2a358c9dc5b95d90c96bbac30ac37f321354b15f4a6fbb6237df766045cf6fef40ee259
TLSH
T1EC01F580E3E7EB3A4DCD114644606E0EC0FB0CB97A8613618B49BC4C6342E1AE9E1745
MD5 SHA1 SHA512 TLSH

Submit Download

$$a410B.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a410B.bat
Size 722B
SHA256 fd03a353f443ecd752d257c2f6ee0479304ae188eee564901685ef972a788d67
MD5 3a9546e4596c0e642dda4a60880c52cc
SHA1 8669b0ade62e303c09babc192d015713d4d8288e
SHA512 51c89d22716de2cdddb3d3ea732b84ca815de8b6b1f20b52098e45df79388664742d68e111a734bd822d997d07a7fe44a617431e447a23fca44169a7b0b22a12
TLSH
T1D801D880E3E7EB7A4DCD114644606E4EC0FB1CBA7A8613619B5EBC4C6342E1BE9E1785
MD5 SHA1 SHA512 TLSH

Submit Download

$$a4541.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a4541.bat
Size 722B
SHA256 abc29d8804f449c9d95514cc8cbf996c07b4d1264027d77377dcc717e78e9807
MD5 ea2509fd8c9613867fb167a4a40fdcbd
SHA1 8f612bb5ec188773c473a33faa8bafa1c8aa4fca
SHA512 ac9288b3465913bbe1ab143a0b5e01f7ac634939fcff41a1e01f54622f0073d9f0beedb823d25e2d5670f30fdc28d7d1fd5ff49e74c5288bf522c9b8953eba0d
TLSH
T1C501D880E3E7EB7A4DCD114644606E4EC0FB1CB97A8613629B5DBC4C6342E1BE9E1745
MD5 SHA1 SHA512 TLSH

Submit Download

$$a4968.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a4968.bat
Size 722B
SHA256 5f7d0ab1d7d10992d090269be5e16559ce6b21f458b096ab312c4701cf6b3b03
MD5 4011b0f07ee48097d154934ab21bf0ef
SHA1 859de3c0fa4ec30998d7231f0841d104c8d2ec10
SHA512 1d86eb70705210839249db279fd2b620875331128568735c90b81cc64abd1609ca968794b85f5ef8b5b99f446784924f074d322484b26c8e592b8e943ab00dda
TLSH
T14E01D880E3E7EB7B4DCE114644606E4EC0FB1CB97A8613619B5DBC4C6342E1BE9E1745
MD5 SHA1 SHA512 TLSH

Submit Download

$$a4D11.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a4D11.bat
Size 722B
SHA256 21fe39dce743af3a0e6038c1d6d76f7a4e5d187d7d867a2e837d86750f5a803d
MD5 895768c02eaf29af50556f69d3e186fc
SHA1 163262582455ff42243b3fd4cb6005237b04d1b1
SHA512 ad8d33ce5cb2ecc41069299848cbc1dc7323e8e516a35a6699d2518ee5af820ed741c9715fec1977f1e9f32ac33a07670b90cf86e3928a7b0c57c2c0bea8e21f
TLSH
T19301D880E3E7EB7A4DCD114644606E4EC0FB1CB97A8613619B5DBC4C6342E1BEAE1745
MD5 SHA1 SHA512 TLSH

Submit Download

$$a50AB.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a50AB.bat
Size 722B
SHA256 18cbd0ee85ec63d4921e00b90caffd5796ffb3ed09fd7045eff64d1acc498099
MD5 9fd264840fa4d3b4bb0ea3970adc8bcd
SHA1 083261af4e46ca2c1539e8e2dbaf402f9822f7d6
SHA512 2596f0d23c422ac6cc5044cad7f13a2e7af7cca986b80366e0b81771516a4579138310ddd71771f834d759530a871e65757a13d333da32a3718f9e50c9ac982e
TLSH
T13A01D880E3E7EB7A4DCD114644606E4EC0FB1CB97A8613619B5EBC4C6342E1BE9E1745
MD5 SHA1 SHA512 TLSH

Submit Download

$$a538A.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a538A.bat
Size 722B
SHA256 f99b8fb8f25b696ba354a336d9db817e9be3898e150cacddb4967f395d70af50
MD5 5c56398044f170e82aecaaf1a0e7b31d
SHA1 965eece41496e037c916bbe4f8ea019585807820
SHA512 84d2d4e5957d429bb1f22f33730acb555165db9b58cba55048ae8df6d0eaf3472da7cd46602ed7ff910101920e857f3de5574666fa2ec497cebeca5d8599fcc7
TLSH
T10101D880E3E7EB7A4DCD114644607E4EC0FB1CB97A8613619B5DBC4C6342E1BE9E1785
MD5 SHA1 SHA512 TLSH

Submit Download

$$a5697.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a5697.bat
Size 722B
SHA256 14f04ca7efaa83b5cc0418f31de2981605c928d8c93e624fc5d294dc99c65fd2
MD5 ef9c5fa7bb53776cc54dea07981043e4
SHA1 6a37b0ddd042e687de81921dafb93c4aca55ed21
SHA512 fee987073fb202344e63cfbd58a8e742edb1d374c618bc2f0194ba8dfac4d5ae4a1f605361f7e6ccbcd537d6e8b8370e9538898b640900fa4999186406d9d3ad
TLSH
T11801D880E3E7EB7A4DCD114644606E4EC0FB1CBA7A8613619B5DBC4C6342E1BE9E1785
MD5 SHA1 SHA512 TLSH

Submit Download

$$a5908.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a5908.bat
Size 722B
SHA256 58bf09a42e56deb6986b04ea901f1c71ed441877fa38de52750e3c3d1773e8fa
MD5 7e600243444f5b2312391d1de408fc76
SHA1 4ee7bdf3c75880fba2b3218136d6ddf6f06ccc55
SHA512 5d2b97ad741a0b8a7790ff31e30cfe537ea55112a4541af06ad1c074893d1f16cfe59b972dae498a0785cb60ceaab1bd03c236dad83ef5c11137cf390a5dc3be
TLSH
T10401D880E3E7EB7B4DCD114644606E4EC0FB1CB97A8613619B5DBC4C6342E1BE9E1745
MD5 SHA1 SHA512 TLSH

Submit Download

$$a5B98.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a5B98.bat
Size 722B
SHA256 4e8bca2eaf025c149eb33f0e56555ad70b307004970a5626df0d01eed6bc5b7e
MD5 f0642f4066a0deea7e0bea3e2ae7c70f
SHA1 f1ee0da3f4d69607b24bdc0d27f3a6551e3eadf8
SHA512 fbe5f47d8035914f02b97a9c650a32c7effd13b1c6a8946204a37b4a858ca213bde026e2600fcc71c8bc057b9677ac7375a74d9018d58d7cbfcbbc18bdd8a029
TLSH
T12501D880E3E7EB7B4DCD114644606E4EC0FB1CBA7A8613619B5DBC4C6342E1BE9E1745
MD5 SHA1 SHA512 TLSH

Submit Download

$$a5E48.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a5E48.bat
Size 722B
SHA256 4da7afa5184529f91fd074aa8390cff33119d0630e4785dc775c9b95b9bb5648
MD5 e05b69d049aafbe9ac5fce35be0e9d64
SHA1 b9b728b13b1b37d738866a0be08928ee40c81a08
SHA512 b4add4ca47eed32ae4bc68c2a301dff808b3a54837f92a2f83bce14587dffe3bcf3d7702fd7b4270f3935f86bfebdc93bf222355a1673550307afb6456d3899d
TLSH
T163012880E3E7EB3B4DCD114644206E0EC0FB0CB97A8613618B4EBC4C6342E1BE9E1745
MD5 SHA1 SHA512 TLSH

Submit Download

$$a6099.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a6099.bat
Size 722B
SHA256 d7d701e9c11c8781efe491727b74101fd0269f221c4160b621eb24b41bde3d2a
MD5 2779f65a6532e7aef8512fc5fec0942e
SHA1 dc9083f326b71f005ce2189749902c004a7052e8
SHA512 cdb408f25aa3fd6fa3b26c9db9863b7b2731d70b24d845627e510e4d991be41f35220487ea950022d152545247ce5b652260e08fcf38fe6e577dd70f22fb4413
TLSH
T179012880E3E7EB3A4DCD114644206E0EC0FB0CBA7A8613618B4DBC4C6342E1BE9E1745
MD5 SHA1 SHA512 TLSH

Submit Download

3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe

Path C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
Size 5.4MB
SHA256 c5515428c596cbc1bb22466c6f7fd8f795f405375f94b049131fbe5e1ee35bb7
MD5 b7062152e738a15fbdce5436bafc5445
SHA1 79b1e7e03cdf1baeef1013cabcd7991276c4bb3b
SHA512 934b14d38283be7a85fe2e28189d034c2162f6ca786473acdbd78d8a1fd37938c49b8f06d314b0b3c5c8f696c3b60fb3e6718cb5c64b714bbb3d4f60126495f2
SSDEEP 98304:iLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLT:0jJl
TLSH
T1D146E08193D9A479E5C3163450B38FCBE7697461E7218B4F906402FDEDC02E5AE2AFB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe

Path C:\Users\Admin\AppData\Local\Temp\3c274158585a0a954eb063180316d2ed02a14a30720907de33d1ff0bba580c7c.exe
Size 5.3MB
SHA256 8ee618327f79d64edbacc8520733c7e03e1f7e126dd0cb77e6d04877a8a9f78f
MD5 489afaec663f619ede77a2dbfe86073b
SHA1 9efab89d0ad8353775e104ca59caccd7d504c626
SHA512 dd360ed10eace2f56f019cb6d190a4b34a69b6aa08174c7a03241bc0f3a613545d5b176469c8a472e484eaf2210efe970fb4204edbaf5aedfdaf00fceb1b5eac
SSDEEP 98304:iLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLf:CjJl
TLSH
T1A746E08193D9A479E5C3163450B38FCBE7697461E7218B4F906402FDEDC02E5AE2AFB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download