Analysis
- max time kernel
149s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
07/08/2026, 00:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe
- Size 9.1MB
- Sample260807-ad9jjsda33
- SHA256 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f
- MD5 c38fb06f3346fcd5c196729fd76b525f
- SHA1 03dde83db86c6b1e5aee40e84525056b1ba23576
- SHA512 09d6b0383f398a08c5f7d0fbf5712f24f7ec7fe7336daffa8d5103d5c40b7abce30bee23408aa1e5c81eeea0d62bab1aa1f2e546ad1c8495fb40e57f963ab654
- SSDEEP 98304:iLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLi:CjJc
- TLSH T145A6E18193D9A479E5C3163450B38FCBE76974B1E6218B4F906402FDEDC02E5AE1AFB4
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1804 Logo1_.exe 4820 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 1936 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 2096 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 5032 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 4716 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 4688 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 4784 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 4528 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 1924 Logo1_.exe 2916 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 4220 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 5088 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 4780 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 3492 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 1896 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 2092 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 4580 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 1820 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 5012 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 4728 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 4256 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 1324 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 3460 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 4504 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 3452 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 1472 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 1620 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 2492 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 4744 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 3996 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 1816 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 1888 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 4724 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 1460 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 376 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 2316 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 1080 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 1364 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 3456 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 5008 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 2008 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 3960 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 4860 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 4028 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 2520 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 3132 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 3112 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 1748 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 204 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 1988 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 2936 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 1928 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 3496 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 2680 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 4172 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 2244 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 4332 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 2132 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 4452 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 3568 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 4368 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 3420 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 2792 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe - Enumerates connected drives 3 TTPs 42 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\_desktop.ini Logo1_.exe File created C:\Program Files\Crashpad\reports\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ar\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\host\fxr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\en-us\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CANYON\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EVRGREEN\_desktop.ini Logo1_.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ca\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\tr\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\cmm\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_f4\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\lt\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\sk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\include\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AFTRNOON\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\Cultures\_desktop.ini Logo1_.exe File created C:\Program Files\Internet Explorer\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\3082\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\bg\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\pl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-BA\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f4\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\fi\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PIXEL\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\cmm\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\Office16\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\hr\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUECALM\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SONORA\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\7-Zip\Lang\_desktop.ini Logo1_.exe File created C:\Program Files\Crashpad\attachments\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\_desktop.ini Logo1_.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File opened for modification C:\Windows\rundl132.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe File created C:\Windows\Logo1_.exe 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe - Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2880 cmd.exe 3908 cmd.exe 2576 cmd.exe 3348 cmd.exe 5772 cmd.exe 5172 cmd.exe 316 cmd.exe 5540 cmd.exe 5280 cmd.exe 5284 cmd.exe 5740 cmd.exe 6060 cmd.exe 4776 cmd.exe 3800 cmd.exe 1328 cmd.exe 5500 cmd.exe 5784 cmd.exe 4444 cmd.exe 5272 cmd.exe 5164 cmd.exe 5196 cmd.exe 5184 cmd.exe 4468 cmd.exe 2472 cmd.exe 5860 cmd.exe 3684 cmd.exe 6076 cmd.exe 5760 cmd.exe 5460 cmd.exe 5908 cmd.exe 2572 cmd.exe 2580 cmd.exe 5216 cmd.exe 6024 cmd.exe 5688 cmd.exe 5428 cmd.exe 5612 cmd.exe 5420 cmd.exe 5072 cmd.exe 2612 cmd.exe 6040 cmd.exe 5944 cmd.exe 3280 cmd.exe 5592 cmd.exe 5036 cmd.exe 2980 cmd.exe 5928 cmd.exe 5484 cmd.exe 5140 cmd.exe 4124 cmd.exe 2968 cmd.exe 4032 cmd.exe 888 cmd.exe 536 cmd.exe 3408 cmd.exe 5464 cmd.exe 988 cmd.exe 5832 cmd.exe 3892 cmd.exe 6016 cmd.exe 3080 cmd.exe 5348 cmd.exe 6052 cmd.exe 716 cmd.exe - Program crash 1 IoCs
pid pid_target Process procid_target 624 1804 WerFault.exe 86 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3068 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 3068 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 3068 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 3068 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 3068 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 3068 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 3068 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 3068 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 3068 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 3068 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 3068 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 3068 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 3068 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 3068 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 3068 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 3068 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 3068 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 3068 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 1804 Logo1_.exe 1804 Logo1_.exe 1804 Logo1_.exe 1804 Logo1_.exe 1804 Logo1_.exe 1804 Logo1_.exe 1804 Logo1_.exe 1804 Logo1_.exe 1804 Logo1_.exe 1804 Logo1_.exe 1804 Logo1_.exe 1804 Logo1_.exe 1804 Logo1_.exe 1804 Logo1_.exe 1804 Logo1_.exe 1804 Logo1_.exe 1804 Logo1_.exe 1804 Logo1_.exe 1804 Logo1_.exe 1804 Logo1_.exe 1804 Logo1_.exe 1804 Logo1_.exe 1804 Logo1_.exe 1804 Logo1_.exe 1804 Logo1_.exe 1804 Logo1_.exe 1804 Logo1_.exe 1804 Logo1_.exe 1804 Logo1_.exe 1804 Logo1_.exe 1804 Logo1_.exe 1804 Logo1_.exe 1804 Logo1_.exe 1804 Logo1_.exe 1804 Logo1_.exe 1804 Logo1_.exe 1804 Logo1_.exe 1804 Logo1_.exe 1804 Logo1_.exe 1804 Logo1_.exe 1804 Logo1_.exe 1804 Logo1_.exe 1804 Logo1_.exe 1804 Logo1_.exe 4528 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 4528 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3068 wrote to memory of 1064 3068 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 85 PID 3068 wrote to memory of 1804 3068 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 86 PID 1804 wrote to memory of 1068 1804 Logo1_.exe 88 PID 1068 wrote to memory of 3360 1068 net.exe 90 PID 1064 wrote to memory of 4820 1064 cmd.exe 91 PID 4820 wrote to memory of 4960 4820 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 92 PID 4960 wrote to memory of 1936 4960 cmd.exe 94 PID 1936 wrote to memory of 4032 1936 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 95 PID 4032 wrote to memory of 2096 4032 cmd.exe 97 PID 2096 wrote to memory of 3088 2096 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 98 PID 3088 wrote to memory of 5032 3088 cmd.exe 102 PID 5032 wrote to memory of 3892 5032 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 103 PID 3892 wrote to memory of 4716 3892 cmd.exe 106 PID 4716 wrote to memory of 1528 4716 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 107 PID 1528 wrote to memory of 4688 1528 cmd.exe 111 PID 4688 wrote to memory of 888 4688 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 112 PID 888 wrote to memory of 4784 888 cmd.exe 118 PID 4784 wrote to memory of 4552 4784 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 119 PID 4552 wrote to memory of 4528 4552 cmd.exe 121 PID 4528 wrote to memory of 4040 4528 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 122 PID 4528 wrote to memory of 1924 4528 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 123 PID 1924 wrote to memory of 3972 1924 Logo1_.exe 125 PID 3972 wrote to memory of 1580 3972 net.exe 162 PID 4040 wrote to memory of 2916 4040 cmd.exe 130 PID 2916 wrote to memory of 4012 2916 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 131 PID 4012 wrote to memory of 4220 4012 cmd.exe 134 PID 4220 wrote to memory of 2148 4220 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 135 PID 2148 wrote to memory of 5088 2148 cmd.exe 137 PID 5088 wrote to memory of 716 5088 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 138 PID 716 wrote to memory of 4780 716 cmd.exe 141 PID 4780 wrote to memory of 2900 4780 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 142 PID 2900 wrote to memory of 3492 2900 cmd.exe 144 PID 3492 wrote to memory of 3904 3492 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 145 PID 3904 wrote to memory of 1896 3904 cmd.exe 147 PID 1896 wrote to memory of 944 1896 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 148 PID 944 wrote to memory of 2092 944 cmd.exe 150 PID 2092 wrote to memory of 3280 2092 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 151 PID 3280 wrote to memory of 4580 3280 cmd.exe 154 PID 4580 wrote to memory of 3772 4580 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 155 PID 3772 wrote to memory of 1820 3772 cmd.exe 157 PID 1820 wrote to memory of 5092 1820 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 158 PID 5092 wrote to memory of 5012 5092 cmd.exe 160 PID 5012 wrote to memory of 1848 5012 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 161 PID 1848 wrote to memory of 4728 1848 cmd.exe 163 PID 4728 wrote to memory of 3052 4728 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 164 PID 3052 wrote to memory of 4256 3052 cmd.exe 166 PID 4256 wrote to memory of 3800 4256 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 167 PID 3800 wrote to memory of 1324 3800 cmd.exe 169 PID 1324 wrote to memory of 4804 1324 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 170 PID 4804 wrote to memory of 3460 4804 cmd.exe 172 PID 3460 wrote to memory of 896 3460 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 173 PID 896 wrote to memory of 4504 896 cmd.exe 175 PID 4504 wrote to memory of 1608 4504 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 176 PID 1608 wrote to memory of 3452 1608 cmd.exe 178 PID 3452 wrote to memory of 3400 3452 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 179 PID 3400 wrote to memory of 1472 3400 cmd.exe 181 PID 1472 wrote to memory of 1420 1472 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 182 PID 1420 wrote to memory of 1620 1420 cmd.exe 184 PID 1620 wrote to memory of 2880 1620 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 185 PID 2880 wrote to memory of 2492 2880 cmd.exe 187 PID 2492 wrote to memory of 5112 2492 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 188 PID 5112 wrote to memory of 4744 5112 cmd.exe 190 PID 4744 wrote to memory of 4440 4744 153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe 191 PID 4440 wrote to memory of 3996 4440 cmd.exe 193
Processes
-
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a562A.bat2⤵
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5995.bat4⤵
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5E28.bat6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a629D.bat8⤵
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a678F.bat10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6C71.bat12⤵
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7450.bat14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7990.bat16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7F0E.bat18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a84DB.bat20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A49.bat22⤵
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F89.bat24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:716 -
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a942D.bat26⤵
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a98C0.bat28⤵
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9EEB.bat30⤵
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA294.bat32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA68C.bat34⤵
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aABDB.bat36⤵
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB0DC.bat38⤵
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV139⤵PID:1580
-
-
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB570.bat40⤵
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB60C.bat42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB699.bat44⤵
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB726.bat46⤵
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB7D2.bat48⤵
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB84F.bat50⤵
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB8DB.bat52⤵
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB987.bat54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA04.bat56⤵
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA71.bat58⤵
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"59⤵
- Executes dropped EXE
PID:3996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBADF.bat60⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"61⤵
- Executes dropped EXE
PID:1816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBBD9.bat62⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"63⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC65.bat64⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"65⤵
- Executes dropped EXE
PID:4724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD50.bat66⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBDDC.bat68⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"69⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE69.bat70⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"71⤵
- Executes dropped EXE
PID:2316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF73.bat72⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"73⤵
- Executes dropped EXE
PID:1080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC02E.bat74⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"75⤵
- Executes dropped EXE
PID:1364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC128.bat76⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"77⤵
- Executes dropped EXE
PID:3456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC1B5.bat78⤵
- Executes a command shell one-liner
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"79⤵
- Executes dropped EXE
PID:5008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC270.bat80⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"81⤵
- Executes dropped EXE
PID:2008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC2ED.bat82⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"83⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC399.bat84⤵
- System Location Discovery: System Language Discovery
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"85⤵
- Executes dropped EXE
PID:4860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC435.bat86⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"87⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC4E1.bat88⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"89⤵
- Executes dropped EXE
PID:2520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC57E.bat90⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"91⤵
- Executes dropped EXE
PID:3132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC5FB.bat92⤵
- Executes a command shell one-liner
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"93⤵
- Executes dropped EXE
PID:3112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC6C6.bat94⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"95⤵
- Executes dropped EXE
PID:1748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC7B0.bat96⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC88B.bat98⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"99⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC927.bat100⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"101⤵
- Executes dropped EXE
PID:2936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA60.bat102⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"103⤵
- Executes dropped EXE
PID:1928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCADD.bat104⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"105⤵
- Executes dropped EXE
PID:3496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCBA8.bat106⤵
- Executes a command shell one-liner
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"107⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC44.bat108⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCCF0.bat110⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"111⤵
- Executes dropped EXE
PID:2244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD8C.bat112⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCE57.bat114⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF42.bat116⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"117⤵
- Executes dropped EXE
PID:4452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCFDE.bat118⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"119⤵
- Executes dropped EXE
PID:3568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD0C8.bat120⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"C:\Users\Admin\AppData\Local\Temp\153eacd0a9ed06b51d405610be70e37bdee561b452f807ee87c147246b4bdc2f.exe"121⤵
- Executes dropped EXE
PID:4368
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-