019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/09/2026, 07:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
Size 4.8MB
Sample260916-hv25ssvsat
SHA256 019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2
MD5 d92778ad9e52003c4ece4fef37065a74
SHA1 c605a06b02ae27216d56868eb8da622567330b38
SHA512 79d124f0b3d0fb72d1ba73ae84c213447adaac839a475e1100595e17e6f6d59ee809c64a8ce6cda1f696a41f0e32e20db5305f32ad4dabc03fcdc513214fe9c3
SSDEEP 98304:iLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLw:z
TLSH
T1F936E18193D9A879E5C3163451738FCBE76964A1F6118B0F90A402FDEDC02E5AF1AFB4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4264	Logo1_.exe
1120	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
2992	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
5400	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
2884	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
1656	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
5520	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
5616	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
2556	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
2192	Logo1_.exe
1552	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
5348	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
5280	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
5152	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
996	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
4160	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
4248	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
3424	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
3968	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
5968	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
268	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
4852	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
1228	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
4928	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
1088	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
712	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
2680	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
3224	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
4200	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
5428	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
1880	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
4744	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
4668	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
4540	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
3984	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
2176	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
2452	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
5276	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
5700	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
1160	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
3340	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
2612	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
2940	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
2232	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
4384	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
4292	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
5852	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
3644	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
3464	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
5432	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
4844	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
3284	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
2320	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
3492	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
3664	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
2576	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
4652	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
1480	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
1728	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
1276	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
936	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
3656	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
4980	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
5920	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe

Enumerates connected drives 3 TTPs 42 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\D:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\D:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\loc\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\cs\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SAMPLES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\applet\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\applet\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_w1\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\BORDERS\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Help\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CASCADE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\fr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUECALM\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\DEEPBLUE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\host\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Extensions\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Internet Explorer\uk-UA\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\management\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\1033\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f2\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\it\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ja\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\_desktop.ini	Logo1_.exe
File created	C:\Program Files\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f4\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\legal\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\he\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SAMPLES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Cultures\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\_desktop.ini	Logo1_.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Dll.dll	Logo1_.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
File created	C:\Windows\Logo1_.exe	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4552	cmd.exe
5528	cmd.exe
2264	cmd.exe
4760	cmd.exe
3980	cmd.exe
3440	cmd.exe
4812	cmd.exe
1648	cmd.exe
948	cmd.exe
4156	cmd.exe
5552	cmd.exe
5380	cmd.exe
3236	cmd.exe
3740	cmd.exe
6108	cmd.exe
4516	cmd.exe
468	cmd.exe
2880	cmd.exe
1868	cmd.exe
1988	cmd.exe
2360	cmd.exe
1700	cmd.exe
5000	cmd.exe
676	cmd.exe
1704	cmd.exe
4128	cmd.exe
4688	cmd.exe
4632	cmd.exe
2840	cmd.exe
5792	cmd.exe
5604	cmd.exe
4436	cmd.exe
6088	cmd.exe
4228	cmd.exe
2952	cmd.exe
4740	cmd.exe
404	cmd.exe
3552	cmd.exe
4560	cmd.exe
4920	cmd.exe
1352	cmd.exe
680	cmd.exe
4356	cmd.exe
3276	cmd.exe
1740	cmd.exe
5724	cmd.exe
5896	cmd.exe
1080	cmd.exe
1980	cmd.exe
2516	cmd.exe
4148	cmd.exe
204	cmd.exe
4624	cmd.exe
5844	cmd.exe
4848	cmd.exe
5764	cmd.exe
1416	cmd.exe
3972	cmd.exe
4308	cmd.exe
3540	cmd.exe
2540	cmd.exe
1380	cmd.exe
4480	cmd.exe
2416	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1316	4264	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
796	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
796	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
796	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
796	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
796	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
796	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
796	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
796	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
796	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
796	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
796	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
796	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
796	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
796	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
796	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
796	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
796	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
796	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
4264	Logo1_.exe
4264	Logo1_.exe
4264	Logo1_.exe
4264	Logo1_.exe
4264	Logo1_.exe
4264	Logo1_.exe
4264	Logo1_.exe
4264	Logo1_.exe
4264	Logo1_.exe
4264	Logo1_.exe
4264	Logo1_.exe
4264	Logo1_.exe
4264	Logo1_.exe
4264	Logo1_.exe
4264	Logo1_.exe
4264	Logo1_.exe
4264	Logo1_.exe
4264	Logo1_.exe
4264	Logo1_.exe
4264	Logo1_.exe
4264	Logo1_.exe
4264	Logo1_.exe
4264	Logo1_.exe
4264	Logo1_.exe
4264	Logo1_.exe
4264	Logo1_.exe
4264	Logo1_.exe
4264	Logo1_.exe
4264	Logo1_.exe
4264	Logo1_.exe
4264	Logo1_.exe
4264	Logo1_.exe
4264	Logo1_.exe
4264	Logo1_.exe
4264	Logo1_.exe
4264	Logo1_.exe
4264	Logo1_.exe
4264	Logo1_.exe
4264	Logo1_.exe
4264	Logo1_.exe
4264	Logo1_.exe
4264	Logo1_.exe
4264	Logo1_.exe
4264	Logo1_.exe
2556	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
2556	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4976	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 796 wrote to memory of 4328	796	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe	89
PID 796 wrote to memory of 4264	796	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe	90
PID 4264 wrote to memory of 2156	4264	Logo1_.exe	92
PID 2156 wrote to memory of 1704	2156	net.exe	94
PID 4328 wrote to memory of 1120	4328	cmd.exe	95
PID 1120 wrote to memory of 3108	1120	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe	96
PID 3108 wrote to memory of 2992	3108	cmd.exe	98
PID 2992 wrote to memory of 4148	2992	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe	99
PID 4148 wrote to memory of 5400	4148	cmd.exe	101
PID 5400 wrote to memory of 4388	5400	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe	102
PID 4388 wrote to memory of 2884	4388	cmd.exe	104
PID 2884 wrote to memory of 4480	2884	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe	105
PID 4480 wrote to memory of 1656	4480	cmd.exe	107
PID 1656 wrote to memory of 404	1656	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe	108
PID 404 wrote to memory of 5520	404	cmd.exe	110
PID 5520 wrote to memory of 4548	5520	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe	111
PID 4548 wrote to memory of 5616	4548	cmd.exe	113
PID 5616 wrote to memory of 2552	5616	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe	114
PID 2552 wrote to memory of 2556	2552	cmd.exe	119
PID 2556 wrote to memory of 2416	2556	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe	120
PID 2556 wrote to memory of 2192	2556	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe	121
PID 2192 wrote to memory of 4676	2192	Logo1_.exe	123
PID 4676 wrote to memory of 3048	4676	net.exe	125
PID 2416 wrote to memory of 1552	2416	cmd.exe	126
PID 1552 wrote to memory of 3020	1552	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe	127
PID 3020 wrote to memory of 5348	3020	cmd.exe	129
PID 5348 wrote to memory of 2364	5348	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe	130
PID 2364 wrote to memory of 5280	2364	cmd.exe	132
PID 5280 wrote to memory of 5264	5280	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe	133
PID 5264 wrote to memory of 5152	5264	cmd.exe	135
PID 5152 wrote to memory of 4552	5152	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe	136
PID 4552 wrote to memory of 996	4552	cmd.exe	138
PID 996 wrote to memory of 3276	996	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe	139
PID 3276 wrote to memory of 4160	3276	cmd.exe	141
PID 4160 wrote to memory of 4128	4160	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe	142
PID 4128 wrote to memory of 4248	4128	cmd.exe	144
PID 4248 wrote to memory of 4688	4248	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe	145
PID 4688 wrote to memory of 3424	4688	cmd.exe	147
PID 3424 wrote to memory of 4812	3424	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe	148
PID 4812 wrote to memory of 3968	4812	cmd.exe	150
PID 3968 wrote to memory of 3768	3968	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe	151
PID 3768 wrote to memory of 5968	3768	cmd.exe	153
PID 5968 wrote to memory of 5820	5968	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe	154
PID 5820 wrote to memory of 268	5820	cmd.exe	156
PID 268 wrote to memory of 1648	268	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe	157
PID 1648 wrote to memory of 4852	1648	cmd.exe	159
PID 4852 wrote to memory of 1740	4852	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe	160
PID 1740 wrote to memory of 1228	1740	cmd.exe	162
PID 1228 wrote to memory of 572	1228	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe	163
PID 572 wrote to memory of 4928	572	cmd.exe	165
PID 4928 wrote to memory of 3792	4928	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe	166
PID 3792 wrote to memory of 1088	3792	cmd.exe	168
PID 1088 wrote to memory of 1380	1088	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe	169
PID 1380 wrote to memory of 712	1380	cmd.exe	171
PID 712 wrote to memory of 5224	712	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe	172
PID 5224 wrote to memory of 2680	5224	cmd.exe	174
PID 2680 wrote to memory of 5768	2680	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe	175
PID 5768 wrote to memory of 3224	5768	cmd.exe	177
PID 3224 wrote to memory of 4308	3224	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe	178
PID 4308 wrote to memory of 4200	4308	cmd.exe	180
PID 4200 wrote to memory of 2492	4200	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe	181
PID 2492 wrote to memory of 5428	2492	cmd.exe	183
PID 5428 wrote to memory of 1732	5428	019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe	184
PID 1732 wrote to memory of 1880	1732	cmd.exe	186

C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
"C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:796
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1013.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4328
- - C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
    "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:1120
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a13AD.bat
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3108
    - - C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2992
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1803.bat
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4148
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5400
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a19F7.bat
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:4388
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2884
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1C96.bat
        10⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        11⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:1656
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1FC3.bat
        12⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:404
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        13⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:5520
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2292.bat
        14⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5616
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a27D1.bat
        16⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        17⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2556
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2F34.bat
        18⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        19⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:1552
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a31D4.bat
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:3020
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5348
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3426.bat
        22⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        23⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5280
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3733.bat
        24⤵
        Suspicious use of WriteProcessMemory
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        25⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5152
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3965.bat
        26⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        27⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:996
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3C15.bat
        28⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3276
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        29⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4160
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3E86.bat
        30⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4128
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        31⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4248
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4126.bat
        32⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        33⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:3424
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a43E5.bat
        34⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        35⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:3968
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4656.bat
        36⤵
        Suspicious use of WriteProcessMemory
        
        PID:3768
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        37⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5968
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4898.bat
        38⤵
        Suspicious use of WriteProcessMemory
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        39⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:268
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4ACB.bat
        40⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1648
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        41⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4852
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4BD4.bat
        42⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        43⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1228
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4CFD.bat
        44⤵
        Suspicious use of WriteProcessMemory
        
        PID:572
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        45⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:4928
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4E36.bat
        46⤵
        Suspicious use of WriteProcessMemory
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        47⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1088
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4F20.bat
        48⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1380
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        49⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:712
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a501A.bat
        50⤵
        Suspicious use of WriteProcessMemory
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        51⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2680
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5152.bat
        52⤵
        Suspicious use of WriteProcessMemory
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        53⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3224
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a524C.bat
        54⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        55⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4200
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5366.bat
        56⤵
        Suspicious use of WriteProcessMemory
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        57⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5428
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a549E.bat
        58⤵
        Suspicious use of WriteProcessMemory
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        59⤵
        Executes dropped EXE
        
        PID:1880
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a55B7.bat
        60⤵
        
        PID:4088
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        61⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4744
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a56D1.bat
        62⤵
        
        PID:1544
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        63⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4668
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a57BB.bat
        64⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4228
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        65⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4540
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a58D4.bat
        66⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        67⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3984
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a59DE.bat
        68⤵
        Executes a command shell one-liner
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        69⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2176
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5AF7.bat
        70⤵
        Executes a command shell one-liner
        
        PID:1080
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        71⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2452
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5C01.bat
        72⤵
        Executes a command shell one-liner
        
        PID:1868
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        73⤵
        Executes dropped EXE
        
        PID:5276
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5D2A.bat
        74⤵
        System Location Discovery: System Language Discovery
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        75⤵
        Executes dropped EXE
        
        PID:5700
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5E04.bat
        76⤵
        Executes a command shell one-liner
        
        PID:948
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        77⤵
        Executes dropped EXE
        
        PID:1160
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5EFE.bat
        78⤵
        Executes a command shell one-liner
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        79⤵
        Executes dropped EXE
        
        PID:3340
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5FE9.bat
        80⤵
        
        PID:4104
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        81⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2612
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a60D3.bat
        82⤵
        
        PID:1784
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        83⤵
        Executes dropped EXE
        
        PID:2940
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a61CD.bat
        84⤵
        
        PID:3724
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        85⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2232
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a62C7.bat
        86⤵
        Executes a command shell one-liner
        
        PID:204
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        87⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4384
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a63E0.bat
        88⤵
        
        PID:3512
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        89⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4292
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a64FA.bat
        90⤵
        System Location Discovery: System Language Discovery
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        91⤵
        Executes dropped EXE
        
        PID:5852
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a65F4.bat
        92⤵
        
        PID:3956
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        93⤵
        Executes dropped EXE
        
        PID:3644
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a66EE.bat
        94⤵
        System Location Discovery: System Language Discovery
        
        PID:4188
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        95⤵
        Executes dropped EXE
        
        PID:3464
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6817.bat
        96⤵
        
        PID:2936
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        97⤵
        Executes dropped EXE
        
        PID:5432
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6920.bat
        98⤵
        Executes a command shell one-liner
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        99⤵
        Executes dropped EXE
        
        PID:4844
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6A39.bat
        100⤵
        System Location Discovery: System Language Discovery
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        101⤵
        Executes dropped EXE
        
        PID:3284
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6B33.bat
        102⤵
        Executes a command shell one-liner
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        103⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2320
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6C1E.bat
        104⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4632
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        105⤵
        Executes dropped EXE
        
        PID:3492
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6D27.bat
        106⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        107⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3664
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6E31.bat
        108⤵
        Executes a command shell one-liner
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        109⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2576
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6F2B.bat
        110⤵
        System Location Discovery: System Language Discovery
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        111⤵
        Executes dropped EXE
        
        PID:4652
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7015.bat
        112⤵
        
        PID:1468
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        113⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1480
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a712F.bat
        114⤵
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        115⤵
        Executes dropped EXE
        
        PID:1728
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a71EA.bat
        116⤵
        Executes a command shell one-liner
        
        PID:4156
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        117⤵
        Executes dropped EXE
        
        PID:1276
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a72E4.bat
        118⤵
        Executes a command shell one-liner
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        119⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:936
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a73BF.bat
        120⤵
        Executes a command shell one-liner
        
        PID:1980
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        121⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3656
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a749A.bat
        122⤵
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        123⤵
        Executes dropped EXE
        
        PID:4980
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a75C3.bat
        124⤵
        
        PID:1176
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        125⤵
        Executes dropped EXE
        
        PID:5920
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a768E.bat
        126⤵
        
        PID:3460
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        127⤵
        Drops file in Windows directory
        
        PID:3488
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7768.bat
        128⤵
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        129⤵
        Drops file in Windows directory
        
        PID:2468
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7872.bat
        130⤵
        
        PID:5032
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        131⤵
        System Location Discovery: System Language Discovery
        
        PID:408
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a794D.bat
        132⤵
        Executes a command shell one-liner
        
        PID:3540
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        133⤵
        
        PID:248
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A37.bat
        134⤵
        Executes a command shell one-liner
        
        PID:3740
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        135⤵
        Drops file in Windows directory
        
        PID:5600
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7B22.bat
        136⤵
        Executes a command shell one-liner
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        137⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7C3B.bat
        138⤵
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        139⤵
        Drops file in Windows directory
        
        PID:52
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7D16.bat
        140⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        141⤵
        
        PID:716
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E2F.bat
        142⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        143⤵
        Drops file in Windows directory
        
        PID:2724
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7F0A.bat
        144⤵
        Executes a command shell one-liner
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        145⤵
        
        PID:2976
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8023.bat
        146⤵
        
        PID:1368
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        147⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2592
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a80EE.bat
        148⤵
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        149⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2020
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a81C9.bat
        150⤵
        Executes a command shell one-liner
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        151⤵
        System Location Discovery: System Language Discovery
        
        PID:560
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a82D2.bat
        152⤵
        System Location Discovery: System Language Discovery
        
        PID:1824
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        153⤵
        Drops file in Windows directory
        
        PID:5796
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a83CC.bat
        154⤵
        System Location Discovery: System Language Discovery
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        155⤵
        
        PID:1516
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a84C6.bat
        156⤵
        Executes a command shell one-liner
        
        PID:3552
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        157⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a85B1.bat
        158⤵
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        159⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a86AB.bat
        160⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        161⤵
        Drops file in Windows directory
        
        PID:3408
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8776.bat
        162⤵
        
        PID:4572
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        163⤵
        
        PID:1896
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a887F.bat
        164⤵
        
        PID:4240
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        165⤵
        
        PID:4400
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8979.bat
        166⤵
        System Location Discovery: System Language Discovery
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        167⤵
        
        PID:800
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A35.bat
        168⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        169⤵
        System Location Discovery: System Language Discovery
        
        PID:2640
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B1F.bat
        170⤵
        System Location Discovery: System Language Discovery
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        171⤵
        Drops file in Windows directory
        
        PID:5740
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C29.bat
        172⤵
        
        PID:3300
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        173⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2824
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D13.bat
        174⤵
        
        PID:256
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        175⤵
        Drops file in Windows directory
        
        PID:2820
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8DEE.bat
        176⤵
        System Location Discovery: System Language Discovery
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        177⤵
        Drops file in Windows directory
        
        PID:4664
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8ED8.bat
        178⤵
        Executes a command shell one-liner
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        179⤵
        Drops file in Windows directory
        
        PID:5892
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F94.bat
        180⤵
        
        PID:240
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        181⤵
        
        PID:1560
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a907E.bat
        182⤵
        Executes a command shell one-liner
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        183⤵
        
        PID:3328
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9169.bat
        184⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        185⤵
        
        PID:2184
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9253.bat
        186⤵
        System Location Discovery: System Language Discovery
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        187⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4656
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a933D.bat
        188⤵
        Executes a command shell one-liner
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        189⤵
        Drops file in Windows directory
        
        PID:4872
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9409.bat
        190⤵
        Executes a command shell one-liner
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        191⤵
        
        PID:2356
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a94D4.bat
        192⤵
        Executes a command shell one-liner
        
        PID:4848
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        193⤵
        
        PID:4608
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a95AE.bat
        194⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        195⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5204
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9699.bat
        196⤵
        Executes a command shell one-liner
        
        PID:676
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        197⤵
        System Location Discovery: System Language Discovery
        
        PID:4768
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9764.bat
        198⤵
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        199⤵
        
        PID:2912
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a985E.bat
        200⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        201⤵
        System Location Discovery: System Language Discovery
        
        PID:3444
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9977.bat
        202⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:2540
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        203⤵
        
        PID:4900
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A71.bat
        204⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        205⤵
        
        PID:2548
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B7B.bat
        206⤵
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        207⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C46.bat
        208⤵
        Executes a command shell one-liner
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        209⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2300
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D01.bat
        210⤵
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        211⤵
        
        PID:2500
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9DDC.bat
        212⤵
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        213⤵
        
        PID:3392
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E98.bat
        214⤵
        Executes a command shell one-liner
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        215⤵
        Drops file in Windows directory
        
        PID:4764
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F63.bat
        216⤵
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        217⤵
        Drops file in Windows directory
        
        PID:5632
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA05D.bat
        218⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        219⤵
        System Location Discovery: System Language Discovery
        
        PID:3652
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA147.bat
        220⤵
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        221⤵
        
        PID:2508
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA222.bat
        222⤵
        Executes a command shell one-liner
        
        PID:2264
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        223⤵
        
        PID:1984
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA2FD.bat
        224⤵
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        225⤵
        
        PID:4720
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA3C8.bat
        226⤵
        Executes a command shell one-liner
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        227⤵
        Drops file in Windows directory
        
        PID:5824
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA493.bat
        228⤵
        Executes a command shell one-liner
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        229⤵
        
        PID:3776
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA58D.bat
        230⤵
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        231⤵
        Drops file in Windows directory
        
        PID:6068
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA677.bat
        232⤵
        System Location Discovery: System Language Discovery
        
        PID:824
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        233⤵
        Drops file in Windows directory
        
        PID:6000
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA742.bat
        234⤵
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        235⤵
        
        PID:4468
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA81D.bat
        236⤵
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        237⤵
        System Location Discovery: System Language Discovery
        
        PID:5396
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA8E8.bat
        238⤵
        
        PID:924
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        239⤵
        Drops file in Windows directory
        
        PID:5940
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA9C3.bat
        240⤵
        Executes a command shell one-liner
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        241⤵
        Drops file in Windows directory
        
        PID:4804
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA6F.bat
        242⤵
        Executes a command shell one-liner
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        243⤵
        Drops file in Windows directory
        
        PID:2152
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB59.bat
        244⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        245⤵
        System Location Discovery: System Language Discovery
        
        PID:2984
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC24.bat
        246⤵
        System Location Discovery: System Language Discovery
        
        PID:4960
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        247⤵
        
        PID:3852
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aACB1.bat
        248⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        249⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4716
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD5D.bat
        250⤵
        System Location Discovery: System Language Discovery
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        251⤵
        Drops file in Windows directory
        
        PID:1664
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE18.bat
        252⤵
        Executes a command shell one-liner
        
        PID:3980
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        253⤵
        
        PID:1192
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAEC4.bat
        254⤵
        Executes a command shell one-liner
        
        PID:1352
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        255⤵
        System Location Discovery: System Language Discovery
        
        PID:4620
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF80.bat
        256⤵
        Executes a command shell one-liner
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        257⤵
        System Location Discovery: System Language Discovery
        
        PID:1328
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB04B.bat
        258⤵
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        259⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2440
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB116.bat
        260⤵
        Executes a command shell one-liner
        
        PID:468
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        261⤵
        Drops file in Windows directory
        
        PID:4940
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB1B2.bat
        262⤵
        Executes a command shell one-liner
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        263⤵
        Drops file in Windows directory
        
        PID:5180
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB27D.bat
        264⤵
        Executes a command shell one-liner
        
        PID:3236
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        265⤵
        
        PID:944
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB31A.bat
        266⤵
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        267⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB3E5.bat
        268⤵
        
        PID:3876
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        269⤵
        Drops file in Windows directory
        
        PID:4376
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB4A0.bat
        270⤵
        
        PID:1124
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        271⤵
        
        PID:724
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB56B.bat
        272⤵
        Executes a command shell one-liner
        
        PID:680
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        273⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB6C3.bat
        274⤵
        System Location Discovery: System Language Discovery
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        275⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:6124
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB78E.bat
        276⤵
        Executes a command shell one-liner
        
        PID:1416
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        277⤵
        
        PID:1440
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB81B.bat
        278⤵
        Executes a command shell one-liner
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        279⤵
        
        PID:2228
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB8B7.bat
        280⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        281⤵
        
        PID:2292
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB963.bat
        282⤵
        Executes a command shell one-liner
        
        PID:5000
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        283⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2348
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA1F.bat
        284⤵
        Executes a command shell one-liner
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        285⤵
        
        PID:964
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBACA.bat
        286⤵
        
        PID:3084
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        287⤵
        
        PID:2460
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB57.bat
        288⤵
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        289⤵
        
        PID:2420
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC13.bat
        290⤵
        Executes a command shell one-liner
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        291⤵
        
        PID:1376
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBCCE.bat
        292⤵
        System Location Discovery: System Language Discovery
        
        PID:3316
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        293⤵
        Drops file in Windows directory
        
        PID:4512
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD5B.bat
        294⤵
        
        PID:412
        
        C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\019f76534884f6de8aedcd3735254c89f54855d77fe0319ef5f0da00a224bdb2.exe"
        295⤵
        Drops file in Windows directory
        
        PID:3728
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBDE7.bat
        296⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4976
        
        C:\Windows\Logo1_.exe
        
        C:\Windows\Logo1_.exe
        18⤵
        Executes dropped EXE
        Enumerates connected drives
        Suspicious use of WriteProcessMemory
        
        PID:2192
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Kingsoft AntiVirus Service"
        19⤵
        Suspicious use of WriteProcessMemory
        
        PID:4676
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        20⤵
        
        PID:3048
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4264
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2156
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1704
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4264 -s 920
    3⤵
    - Program crash
    PID:1316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 4264 -ip 4264
1⤵
PID:5476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

$$a1013.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a1013.bat
Size 722B
SHA256 8b59dfd61a00a5b63006ca9b3dde2e8fa1920c99d4e76c52776b6892b0db1509
MD5 f47a61ec2941ec39937e6cae44b36750
SHA1 8b7aca666430d5f9e85bedbbb0c5f3c67c384210
SHA512 a491ad3b9d0192f0c7295eaef6124c43bc90befa16cbeb43adb51a8fe1aced16eb012b4a80c5146052c4cbdca4040d1e98bf9281796dc3ffa1336df575d611aa
TLSH
T10501448243D6432F8506501F4798B8CFC1A2456E3F437BEB69B1AD492D90E1D73E2592
MD5 SHA1 SHA512 TLSH

Submit Download

$$a13AD.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a13AD.bat
Size 722B
SHA256 83f105528e1d7fdadac8bef80f64a10c8db75be451d45e547962e78dd511666b
MD5 8bc09c84a949686359445734dfb3d66a
SHA1 612ce141c44b726673d0071dcd6763c6866d6953
SHA512 57b983fa9ea76c16bad1560a2fedaceb4a890d5b77f32e2dfab9183a75f81e44c7234053437a7a4c8a986d1c4e282f40976bb8202836dc0d68e5868b4932a040
TLSH
T16B01448243D6432F4506500F4798B8CFC1A6456E3F437BEB69B1AD493D90E1D73E2592
MD5 SHA1 SHA512 TLSH

Submit Download

$$a1803.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a1803.bat
Size 722B
SHA256 6421f80c4786beb091ee3eb948aa40f3a8cd221da01f65a7c779729bd24fa063
MD5 51ce7dd9e6d3c54b1e6e347de1545d9e
SHA1 fa2688a29c22ae173b0bccd3ec89efc10bb2ef6d
SHA512 32e78b51cff0ba824e5e4a11ea9c28d984b171ad3bb98a7234e492ba3d8d2131b612c939fdef47cf053b6687a45212f0e3bb0ab493aec6d70b1ca58fdfc1ce25
TLSH
T14C01448243D6472F4506500F4798B8CFC1A2456E3F437BEB69B1AD492D90E1D73E2592
MD5 SHA1 SHA512 TLSH

Submit Download

$$a19F7.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a19F7.bat
Size 722B
SHA256 d75b15c2653e0e4746c3fb5d7913f993e2ed77a51a074f04cf5ff6ce57d83f30
MD5 26007df9c46671f7fbc4bd677b5f5893
SHA1 f3e0ab42fb6ad3d8198eaa72da241f59ff205708
SHA512 f9ac64613236bc0844e334b27958ed6901ccf665f294f7c96ed3cb875850cf391f9fe478ebe2c497b672d88b6605eaa4b67aacbae8af95f22a867c8c09aab536
TLSH
T1FB01448243D6433F4506500F4B98B8CFC1A2456E3F437BEB69B1AD493D90E1D73E2592
MD5 SHA1 SHA512 TLSH

Submit Download

$$a1C96.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a1C96.bat
Size 722B
SHA256 8c9cb9736192b5bfff5c8d3ccdad5bbac13958e1a121f8bb52042e2ce56b5d0e
MD5 5cd10e3c305d3bc2458d9de293521d51
SHA1 217adda077de9cdcc3a6575e8dc3fcf9859d164e
SHA512 246f70cabc59771ec0c127b821bde203fac337ac3c5a374142cbd31b42154ac7198b46b2bfbcdc8a00ffae3b020343adf4cea749901e91957a367a5da641fc96
TLSH
T1BA0144C247D6432F8506500F4798B8CFC2A2456F3F437BEB69B1AD492DA0E1D73E2592
MD5 SHA1 SHA512 TLSH

Submit Download

$$a1FC3.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a1FC3.bat
Size 722B
SHA256 a0015d154735b9008a95122798b837ba6d093d0aa816afc27ac30b78b389e71c
MD5 b2d6a81a87f662055050d93d375b96c8
SHA1 5dc29126f562c4686446ab18dae340e993f9590f
SHA512 b7845310477c287dac2dae77f4b54348bf589c14a8ecacfabf16654f7cb74baa5584e673e338582c514c5723570c2973970cd6f3c2fa907bf81d7a34ebba138c
TLSH
T16101448243D6432F4506500F4798B8CFC1A2456E3F437BEB69B1AD492D90E1D73E2592
MD5 SHA1 SHA512 TLSH

Submit Download

$$a2292.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a2292.bat
Size 722B
SHA256 27cf2b41c1891d7aa1e867d5c88921d5abb78adf934212e6f4b8609b0ec4d559
MD5 251d338005b49296fd2103091f8abffc
SHA1 c370e9e0dee4e72e774cddb23ed67988d9fa0bf1
SHA512 482ced8e5e9dd8139be054a20efa228e4df28fa14a0b2a4ad88e5fa7e35a00f4b155147ffa5c58fb8ef6ec37248a67ce1c3d2644d3ce93ad300cd7a31ccff0fe
TLSH
T1DF01448243D6432F4506504F4798B8CFC1A245AF3F437BEB69B1AD492D90E1D73E2992
MD5 SHA1 SHA512 TLSH

Submit Download

$$a27D1.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a27D1.bat
Size 722B
SHA256 2fafc2274d8ac5596a3d833f344d374cb809297e53793e91c252438ca34207d8
MD5 dc3275e63e7b377488c5baef3a4a6ff3
SHA1 8815e87791d96190ba8e684919021b01ab96618d
SHA512 dd4a1ab298c18b423912029ad6fe0e62a14718e9fd94012d626f6cd81fcc4943bd287960ade8c7a8db72a9b893b98604ad602251c9a4c7662535b7c0c71e1ca9
TLSH
T12801449243D6432F4506500F4798B8CFC1A2456E3F437BEB69B1AD492D90E1D73E2592
MD5 SHA1 SHA512 TLSH

Submit Download

$$a2F34.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a2F34.bat
Size 722B
SHA256 ec862dead6d48b024bb97941e3c0f3b7a1320913d1f807cc1cdf492080b1b324
MD5 238de6409111c55d57c6e6cd5905f637
SHA1 06b041ce1a41fb77c88cc99b915d5b5fe187b273
SHA512 efbac7af2b66c8a745fc0e8ef06630e52c94254ced74cd1c3b0769e84316bdfc3d5c874b2fbe3e430e6dc168299c11009d0e3b1d420481f4bc952cbc212557dc
TLSH
T18201448243D6432F4506500F4798B8CFD2A2456E3F437BEB69B1AD493D90E1D73E2592
MD5 SHA1 SHA512 TLSH

Submit Download

$$a31D4.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a31D4.bat
Size 722B
SHA256 8b32107e9fad90d5954b4bc79abf4dc154722acb4421acbb07daa256e8ee9c0a
MD5 76d869ebfd1bd40d75df6cedb18ef8de
SHA1 63b5498601b107b884f813a1fde949c79d3c1b0e
SHA512 2ee7b5565d7c7dea955d385e2b4f92364eb75fc2fc32d6853b4d1d8a46f7a60792dcfa8ebcff3d462c2d112fbaf78044a549117b21c5f2a19e865d0d8ad43fcc
TLSH
T11201448243D6432F4506500F4798B8CFC1A2456F3F437BEB69B1AD493D90E1D73E2592
MD5 SHA1 SHA512 TLSH

Submit Download

$$a3426.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a3426.bat
Size 722B
SHA256 74a3cbe08e426616d68a53578adeedfca6913b0d5e7b4f9bdc2fa1cc6e828f05
MD5 aa455f678116951ca515c21d1a98a02a
SHA1 bf1375dc0dada9c50efa2b94949877f42b412342
SHA512 b3609f3d4cdbcd65f79f534090a211dd08c8259e27144af51707d16dddb37e3be219423f0ec779b983ce84d473553c46e4ca336a877e50486d73aa0b5e645a85
TLSH
T12D01448243D6432F4506500F4798B8CFC2A2456E3F437BEB69B1ED492D90E1D73E2592
MD5 SHA1 SHA512 TLSH

Submit Download

$$a3733.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a3733.bat
Size 722B
SHA256 ad2faae6a390b5e9d84159d1a889af93bd02059f706d7dc92ffe19658f7476b3
MD5 45ecca9d2fc457e35a79b134fd33c8c7
SHA1 0b34f99308f80bdd8a1bb944a587f6cc340a5096
SHA512 034668df1e11378993e4af2a377336f943be8f9e92760201360390cf5cbaf32e229bb3373764be036ee08239361c072450efce712dc8a1652e5a0b861d755840
TLSH
T1CA01448243D6432F4516500F4798B8CFC1A2466E3F437BEB69B1AD492D90E1D73E2992
MD5 SHA1 SHA512 TLSH

Submit Download

$$a3965.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a3965.bat
Size 722B
SHA256 ae2e6cf5345a23e8a3d178401e4c861ffa852141625291aaac48d2c0ebe4c8da
MD5 e8f3985dbafd18b767b2857c2824d8cc
SHA1 0bbd38a03dcf80d5272d1e97b0ef040ec22d3963
SHA512 3c9c37cb7889a7db157854e178942bc2f69dfc14c7339c664a27765a6223edf47609591272b574a518ee8f93d09242a7c53eee61b4f6d548d2f4f175dbe5e3e1
TLSH
T1C001448243D6432F4506500F4B98B8CFC1A6456E3F437BEB69B1AD492D90E1D73E2592
MD5 SHA1 SHA512 TLSH

Submit Download

$$a3C15.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a3C15.bat
Size 722B
SHA256 81be2fe2e7e2200f833d2ea24ff10b88100c0a99852fe723ec4cf124931a9e89
MD5 45a019b715cb031ca1604c373a32145b
SHA1 41087e6c505708993630ef2285058de7435d08b0
SHA512 86cbe1eb26f2be65e2ae5593109110a98c7aae1ee8e431da51f8ce2791beaf368e71ca26fff7a25459156c50394231eeed9b23886ab1b25b8c0c4031ca04c097
TLSH
T1C90144C243D6432F4506500F4798B8CFC1A2456E3F437BEB69B1AD492D90E1D73E2592
MD5 SHA1 SHA512 TLSH

Submit Download

$$a3E86.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a3E86.bat
Size 722B
SHA256 b0570dcd3650ca4b4ae8adb7b2d9b167ba175cb9998cae322880d6f0f8f8421a
MD5 2a3d6edbbdccf3c3e65f9f404b5954f2
SHA1 18c5c3011920b6749640f7e76a8a0d7358ec79d0
SHA512 3ced2837fd0abe2c1d0ce646d508a64a98934203cc9ed2650d963354a2381b465b64a0bb842113e506ce766d7f31c1d8eaf5b88391b1ec87f2db7528c4342e50
TLSH
T14E01449243D6432F8506500F4798B8CFC1A2456E3F437BEB69B1ED492D90E1D73E2592
MD5 SHA1 SHA512 TLSH

Submit Download

$$a4126.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a4126.bat
Size 722B
SHA256 e0deb0507adc5898abccd837f4a48c101184cf2152574946dcfd293924218524
MD5 cc894c50d92717898156eb762900bb8c
SHA1 5a68bfbc0765e0b27b5d61af7e21eb193160384a
SHA512 ef2d2ca56afa560bf9e55d62a477d99976279f363b36890d72cbb34c92cbd9167a213e6f1be8ce09ec7e9986b5f7d91d945b50ab002631579cc47af780a937d8
TLSH
T16001448243D6432F8506500F4798B8CFC2A2456F3F437BEB69B1AD492D90E1D73E2592
MD5 SHA1 SHA512 TLSH

Submit Download

$$a43E5.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a43E5.bat
Size 722B
SHA256 e3df0eab14fcda5bd81bc3f7c6855dd0cd8b32d5cea46ffdbc09289399979bf6
MD5 2743032fa91c3f94b73dcadd93ceddb5
SHA1 26f8289a3a4a118915740db6ef2dd42bafba43ba
SHA512 1ef907a640877bb4fe3fa642549293e6e98b312a8d29477bc3874e8a8babb42ae25c74a55f0ae1fdfe6ea4708a73cbc1e9831100c10118e26a2c195626876a41
TLSH
T1180184C243D6432F4406500F4798B8CFC1A2466E3F437BEB69B1AC492D90E0D73E2592
MD5 SHA1 SHA512 TLSH

Submit Download

$$a4656.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a4656.bat
Size 722B
SHA256 36b0d499c4a4f514bf16538f957395eb4851747352b83af9539756ed6f33bfc8
MD5 5036be576e81a97e19e2421ba4111c46
SHA1 878013ec666437aefc854a77912ad03c815c81a5
SHA512 638822dfbf337f74e0083e6e56886c0f8dfcc1e065ecd94ea6eb875f1305e003f2c7ef63e63508d0a8c865e569b5643b63cc0b42fea8633c3ea3b02e8ba0a31a
TLSH
T1600144C247D6432F4506500F4798B8CFC2A2466E3F437BEB69B1ED492DA0E1D73E2992
MD5 SHA1 SHA512 TLSH

Submit Download